pony | af302a53c2503bbf4e2dc2a5b3ba653b5156532fd1ce50be0a55863b13437509

Analysis

max time kernel
147s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
Size 2.2MB
Sample240614-dag7nsselc
SHA256 af302a53c2503bbf4e2dc2a5b3ba653b5156532fd1ce50be0a55863b13437509
MD5 a7c10370700b2e51a4e0c2f9ca19899a
SHA1 cee3acc4c2715a18654d1a84a091f97f49bc9b43
SHA512 dc52fb95610e640e9620ed235bb065b63c1df0569d6258fa574c0cba27d264299289629e7a8dbd1571008d872422a0e7109a2f4bff80801e4ec65aa108485801
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZr:0UzeyQMS4DqodCnoe+iitjWwwf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4620	explorer.exe
924	explorer.exe
2104	spoolsv.exe
2884	spoolsv.exe
2720	spoolsv.exe
4828	spoolsv.exe
4824	spoolsv.exe
1260	spoolsv.exe
3116	spoolsv.exe
2572	spoolsv.exe
3160	spoolsv.exe
3396	spoolsv.exe
3240	spoolsv.exe
5084	spoolsv.exe
2316	spoolsv.exe
3736	spoolsv.exe
4288	spoolsv.exe
2152	spoolsv.exe
980	spoolsv.exe
2608	spoolsv.exe
5064	spoolsv.exe
1968	spoolsv.exe
1580	spoolsv.exe
4576	spoolsv.exe
3352	spoolsv.exe
4792	spoolsv.exe
3696	spoolsv.exe
1552	spoolsv.exe
2044	spoolsv.exe
3348	spoolsv.exe
4932	spoolsv.exe
1596	spoolsv.exe
1476	spoolsv.exe
1904	spoolsv.exe
4768	spoolsv.exe
456	spoolsv.exe
1592	spoolsv.exe
4444	spoolsv.exe
4712	explorer.exe
4616	spoolsv.exe
2136	spoolsv.exe
4120	spoolsv.exe
1300	spoolsv.exe
1312	spoolsv.exe
1852	spoolsv.exe
2700	spoolsv.exe
1152	spoolsv.exe
1440	spoolsv.exe
984	spoolsv.exe
820	spoolsv.exe
1428	explorer.exe
4952	spoolsv.exe
1448	spoolsv.exe
4204	spoolsv.exe
3724	spoolsv.exe
1684	spoolsv.exe
1112	spoolsv.exe
4544	spoolsv.exe
920	spoolsv.exe
876	explorer.exe
3664	spoolsv.exe
772	spoolsv.exe
1208	spoolsv.exe
1772	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 2592 set thread context of 812	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	86
PID 4620 set thread context of 924	4620	explorer.exe	91
PID 2104 set thread context of 4444	2104	spoolsv.exe	127
PID 2884 set thread context of 4616	2884	spoolsv.exe	129
PID 2720 set thread context of 2136	2720	spoolsv.exe	130
PID 4828 set thread context of 1300	4828	spoolsv.exe	132
PID 4824 set thread context of 1312	4824	spoolsv.exe	133
PID 1260 set thread context of 1852	1260	spoolsv.exe	134
PID 3116 set thread context of 2700	3116	spoolsv.exe	135
PID 2572 set thread context of 1152	2572	spoolsv.exe	136
PID 3160 set thread context of 1440	3160	spoolsv.exe	137
PID 3396 set thread context of 984	3396	spoolsv.exe	138
PID 3240 set thread context of 820	3240	spoolsv.exe	139
PID 5084 set thread context of 1448	5084	spoolsv.exe	141
PID 2316 set thread context of 4204	2316	spoolsv.exe	143
PID 3736 set thread context of 3724	3736	spoolsv.exe	144
PID 4288 set thread context of 1684	4288	spoolsv.exe	145
PID 2152 set thread context of 1112	2152	spoolsv.exe	146
PID 980 set thread context of 4544	980	spoolsv.exe	147
PID 2608 set thread context of 920	2608	spoolsv.exe	148
PID 5064 set thread context of 772	5064	spoolsv.exe	151
PID 1968 set thread context of 1208	1968	spoolsv.exe	152
PID 1580 set thread context of 1772	1580	spoolsv.exe	153
PID 4576 set thread context of 4740	4576	spoolsv.exe	154
PID 3352 set thread context of 3452	3352	spoolsv.exe	155
PID 4792 set thread context of 1528	4792	spoolsv.exe	156
PID 3696 set thread context of 1524	3696	spoolsv.exe	157
PID 1552 set thread context of 3344	1552	spoolsv.exe	159
PID 2044 set thread context of 1956	2044	spoolsv.exe	161
PID 3348 set thread context of 3800	3348	spoolsv.exe	162
PID 4932 set thread context of 3340	4932	spoolsv.exe	163
PID 1596 set thread context of 2236	1596	spoolsv.exe	164
PID 1476 set thread context of 3132	1476	spoolsv.exe	166
PID 1904 set thread context of 2460	1904	spoolsv.exe	167
PID 4768 set thread context of 3612	4768	spoolsv.exe	169
PID 456 set thread context of 4316	456	spoolsv.exe	170
PID 1592 set thread context of 4924	1592	spoolsv.exe	173
PID 4712 set thread context of 4372	4712	explorer.exe	179
PID 4120 set thread context of 1936	4120	spoolsv.exe	182
PID 1428 set thread context of 2480	1428	explorer.exe	188
PID 4952 set thread context of 2928	4952	spoolsv.exe	190
PID 876 set thread context of 1584	876	explorer.exe	197
PID 3664 set thread context of 2500	3664	spoolsv.exe	198
PID 2284 set thread context of 4024	2284	spoolsv.exe	204
PID 1576 set thread context of 4636	1576	explorer.exe	207
PID 1880 set thread context of 1016	1880	spoolsv.exe	209
PID 1688 set thread context of 2512	1688	explorer.exe	211
PID 4228 set thread context of 4724	4228	spoolsv.exe	213
PID 1176 set thread context of 4476	1176	spoolsv.exe	215
PID 4984 set thread context of 516	4984	explorer.exe	217
PID 1632 set thread context of 4400	1632	spoolsv.exe	219
PID 1640 set thread context of 1368	1640	spoolsv.exe	221
PID 5044 set thread context of 344	5044	spoolsv.exe	223
PID 4420 set thread context of 3508	4420	spoolsv.exe	225
PID 4328 set thread context of 2340	4328	spoolsv.exe	226
PID 4492 set thread context of 212	4492	spoolsv.exe	228

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
812	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
812	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
924	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
812	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
812	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
924	explorer.exe
4444	spoolsv.exe
4444	spoolsv.exe
4616	spoolsv.exe
4616	spoolsv.exe
2136	spoolsv.exe
2136	spoolsv.exe
1300	spoolsv.exe
1300	spoolsv.exe
1312	spoolsv.exe
1312	spoolsv.exe
1852	spoolsv.exe
1852	spoolsv.exe
2700	spoolsv.exe
2700	spoolsv.exe
1152	spoolsv.exe
1152	spoolsv.exe
1440	spoolsv.exe
1440	spoolsv.exe
984	spoolsv.exe
984	spoolsv.exe
820	spoolsv.exe
820	spoolsv.exe
1448	spoolsv.exe
1448	spoolsv.exe
4204	spoolsv.exe
4204	spoolsv.exe
3724	spoolsv.exe
3724	spoolsv.exe
1684	spoolsv.exe
1684	spoolsv.exe
1112	spoolsv.exe
1112	spoolsv.exe
4544	spoolsv.exe
4544	spoolsv.exe
920	spoolsv.exe
920	spoolsv.exe
772	spoolsv.exe
772	spoolsv.exe
1208	spoolsv.exe
1208	spoolsv.exe
1772	spoolsv.exe
1772	spoolsv.exe
4740	spoolsv.exe
4740	spoolsv.exe
3452	spoolsv.exe
3452	spoolsv.exe
1528	spoolsv.exe
1528	spoolsv.exe
1524	spoolsv.exe
1524	spoolsv.exe
3344	spoolsv.exe
3344	spoolsv.exe
1956	spoolsv.exe
1956	spoolsv.exe
3800	spoolsv.exe
3800	spoolsv.exe
3340	spoolsv.exe
3340	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1948	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	81
PID 2592 wrote to memory of 1948	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	81
PID 2592 wrote to memory of 812	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	86
PID 2592 wrote to memory of 812	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	86
PID 2592 wrote to memory of 812	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	86
PID 2592 wrote to memory of 812	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	86
PID 2592 wrote to memory of 812	2592	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	86
PID 812 wrote to memory of 4620	812	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	87
PID 812 wrote to memory of 4620	812	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	87
PID 812 wrote to memory of 4620	812	a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe	87
PID 4620 wrote to memory of 924	4620	explorer.exe	91
PID 4620 wrote to memory of 924	4620	explorer.exe	91
PID 4620 wrote to memory of 924	4620	explorer.exe	91
PID 4620 wrote to memory of 924	4620	explorer.exe	91
PID 4620 wrote to memory of 924	4620	explorer.exe	91
PID 924 wrote to memory of 2104	924	explorer.exe	92
PID 924 wrote to memory of 2104	924	explorer.exe	92
PID 924 wrote to memory of 2104	924	explorer.exe	92
PID 924 wrote to memory of 2884	924	explorer.exe	93
PID 924 wrote to memory of 2884	924	explorer.exe	93
PID 924 wrote to memory of 2884	924	explorer.exe	93
PID 924 wrote to memory of 2720	924	explorer.exe	94
PID 924 wrote to memory of 2720	924	explorer.exe	94
PID 924 wrote to memory of 2720	924	explorer.exe	94
PID 924 wrote to memory of 4828	924	explorer.exe	95
PID 924 wrote to memory of 4828	924	explorer.exe	95
PID 924 wrote to memory of 4828	924	explorer.exe	95
PID 924 wrote to memory of 4824	924	explorer.exe	96
PID 924 wrote to memory of 4824	924	explorer.exe	96
PID 924 wrote to memory of 4824	924	explorer.exe	96
PID 924 wrote to memory of 1260	924	explorer.exe	97
PID 924 wrote to memory of 1260	924	explorer.exe	97
PID 924 wrote to memory of 1260	924	explorer.exe	97
PID 924 wrote to memory of 3116	924	explorer.exe	98
PID 924 wrote to memory of 3116	924	explorer.exe	98
PID 924 wrote to memory of 3116	924	explorer.exe	98
PID 924 wrote to memory of 2572	924	explorer.exe	99
PID 924 wrote to memory of 2572	924	explorer.exe	99
PID 924 wrote to memory of 2572	924	explorer.exe	99
PID 924 wrote to memory of 3160	924	explorer.exe	100
PID 924 wrote to memory of 3160	924	explorer.exe	100
PID 924 wrote to memory of 3160	924	explorer.exe	100
PID 924 wrote to memory of 3396	924	explorer.exe	101
PID 924 wrote to memory of 3396	924	explorer.exe	101
PID 924 wrote to memory of 3396	924	explorer.exe	101
PID 924 wrote to memory of 3240	924	explorer.exe	102
PID 924 wrote to memory of 3240	924	explorer.exe	102
PID 924 wrote to memory of 3240	924	explorer.exe	102
PID 924 wrote to memory of 5084	924	explorer.exe	103
PID 924 wrote to memory of 5084	924	explorer.exe	103
PID 924 wrote to memory of 5084	924	explorer.exe	103
PID 924 wrote to memory of 2316	924	explorer.exe	104
PID 924 wrote to memory of 2316	924	explorer.exe	104
PID 924 wrote to memory of 2316	924	explorer.exe	104
PID 924 wrote to memory of 3736	924	explorer.exe	105
PID 924 wrote to memory of 3736	924	explorer.exe	105
PID 924 wrote to memory of 3736	924	explorer.exe	105
PID 924 wrote to memory of 4288	924	explorer.exe	106
PID 924 wrote to memory of 4288	924	explorer.exe	106
PID 924 wrote to memory of 4288	924	explorer.exe	106
PID 924 wrote to memory of 2152	924	explorer.exe	107
PID 924 wrote to memory of 2152	924	explorer.exe	107
PID 924 wrote to memory of 2152	924	explorer.exe	107
PID 924 wrote to memory of 980	924	explorer.exe	108

C:\Users\Admin\AppData\Local\Temp\a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a7c10370700b2e51a4e0c2f9ca19899a_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:812
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4712
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1428
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2316
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:876
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3344
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:1576
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4932
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2460
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1688
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1936
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4532
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2928
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2500
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2284
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1016
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4476
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1368
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2340
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4492
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 2c38e2a87658d55ed5c5115b9a9a7599599a7b5e0c0b3d6c9d4c96315bfee550
MD5 c4bc59747779f679628ede633117d500
SHA1 8a0a00e8e87ddffad05b20e8ea5eed1a6f02f73d
SHA512 fb4a1c1cc4a4b89d7d942a4269dd0d7039fe315a2e341a00e93ec0c6750241d19a0d88818a75bc39691ed609eec10c78ef243ecfe76eeeb1e23b781fc06037d4
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 942d3b58039fc3455c3f44045bfc25fe4ede80458431cf3bcfe47dc7a5184525
MD5 efa3dfbc4fd2125e71bb687b6b6a9b80
SHA1 a24c117c64ac29c0dba5846120360fda4f1f2bc8
SHA512 342f4e451fcaf561ac0a04c41859a52fa14e0042d863f3c326975f251e5421a92d6f67a0daea2d28e19f45a2d959e6e2d875d4b510e6a13fe627d818c27ffdbe
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWwwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/180-6034-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/344-5805-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/516-5566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/772-2929-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/812-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/812-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/812-87-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/812-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/820-2628-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/820-2802-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/920-2846-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/924-104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/924-1069-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/980-2053-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/984-2559-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1016-5465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1016-5344-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-2538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1208-2939-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1260-1443-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1300-2494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1312-2509-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1368-5972-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1368-5795-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1440-2549-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1448-2697-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1528-2978-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1580-2300-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1584-4783-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1684-2738-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1772-2949-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1852-2519-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1936-4064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1968-2299-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2104-2371-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2104-1070-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2136-2399-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2152-2052-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2236-3169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2316-1882-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2340-5996-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2460-3323-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2460-3443-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2480-4279-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2500-4791-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2500-4924-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2512-5356-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2572-1445-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2580-6024-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2592-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/2592-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2592-43-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/2592-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2608-2054-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2616-6018-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2700-2530-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2720-2389-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2720-1277-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2884-1276-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2884-2381-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2928-4496-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2928-4348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3116-1444-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3160-1651-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3240-1653-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3340-3160-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3344-3137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3352-2375-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3396-1652-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3452-2968-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3508-5907-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3612-3330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3696-2392-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3724-2727-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3736-1883-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4016-6041-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4024-5258-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4024-5130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4204-2718-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4288-1889-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4316-3341-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4372-3824-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4400-5663-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4400-5660-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-2605-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-2376-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4476-5556-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4544-2758-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4576-2374-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4616-2385-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4620-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4620-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4636-5201-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4724-5445-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4740-2958-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4792-2384-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4824-1279-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4828-1278-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4924-3501-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4924-3614-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5064-2298-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5084-1881-0x0000000000400000-0x00000000005D3000-memory.dmp

Download