pony | 76dac540d71bffc127e999033055cc382b0bc990c0d1a57317f10c21dd124e13

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
Size 2.2MB
Sample240614-h5425stdnl
SHA256 76dac540d71bffc127e999033055cc382b0bc990c0d1a57317f10c21dd124e13
MD5 a87eb81d9f08c89d415d7ef98246fa70
SHA1 8884b0f6db9541c6790b38276a2ea1770c3ebaf1
SHA512 e01e7004217734d903204f9829bae3290b6c05332600e233120bf4d2186b9569002ede4c9d4fcddd7604dc43d3df41f0f9e51edac7dbaee0740746797bda5e1c
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZK:0UzeyQMS4DqodCnoe+iitjWwwG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4100	explorer.exe
1520	explorer.exe
1672	spoolsv.exe
4308	spoolsv.exe
3308	spoolsv.exe
3368	spoolsv.exe
1256	spoolsv.exe
5040	spoolsv.exe
4904	spoolsv.exe
4276	spoolsv.exe
5112	spoolsv.exe
4532	spoolsv.exe
1244	spoolsv.exe
4500	spoolsv.exe
572	spoolsv.exe
1956	spoolsv.exe
3304	spoolsv.exe
4480	spoolsv.exe
412	spoolsv.exe
4260	spoolsv.exe
3248	spoolsv.exe
2680	spoolsv.exe
1964	spoolsv.exe
2588	spoolsv.exe
1460	spoolsv.exe
1968	spoolsv.exe
1880	spoolsv.exe
2768	spoolsv.exe
436	spoolsv.exe
1268	spoolsv.exe
448	spoolsv.exe
2304	spoolsv.exe
5192	spoolsv.exe
5564	spoolsv.exe
5652	spoolsv.exe
5692	explorer.exe
5744	spoolsv.exe
6104	spoolsv.exe
3964	spoolsv.exe
5132	spoolsv.exe
5220	spoolsv.exe
5316	spoolsv.exe
5384	spoolsv.exe
5772	spoolsv.exe
5760	explorer.exe
6004	spoolsv.exe
5032	spoolsv.exe
5144	spoolsv.exe
736	spoolsv.exe
5296	spoolsv.exe
3100	spoolsv.exe
5700	spoolsv.exe
4640	explorer.exe
4312	spoolsv.exe
5920	spoolsv.exe
1512	spoolsv.exe
3656	spoolsv.exe
4704	spoolsv.exe
1976	spoolsv.exe
1500	explorer.exe
5440	spoolsv.exe
1608	spoolsv.exe
5080	spoolsv.exe
5312	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 3300 set thread context of 3888	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	95
PID 4100 set thread context of 1520	4100	explorer.exe	101
PID 1672 set thread context of 5652	1672	spoolsv.exe	135
PID 4308 set thread context of 5744	4308	spoolsv.exe	137
PID 3308 set thread context of 3964	3308	spoolsv.exe	139
PID 3368 set thread context of 5132	3368	spoolsv.exe	140
PID 1256 set thread context of 5220	1256	spoolsv.exe	141
PID 5040 set thread context of 5316	5040	spoolsv.exe	142
PID 4904 set thread context of 5384	4904	spoolsv.exe	143
PID 4276 set thread context of 5772	4276	spoolsv.exe	144
PID 5112 set thread context of 5032	5112	spoolsv.exe	147
PID 4532 set thread context of 5144	4532	spoolsv.exe	148
PID 1244 set thread context of 736	1244	spoolsv.exe	149
PID 4500 set thread context of 5296	4500	spoolsv.exe	150
PID 572 set thread context of 3100	572	spoolsv.exe	151
PID 1956 set thread context of 5700	1956	spoolsv.exe	152
PID 3304 set thread context of 4312	3304	spoolsv.exe	154
PID 4480 set thread context of 5920	4480	spoolsv.exe	155
PID 412 set thread context of 3656	412	spoolsv.exe	157
PID 4260 set thread context of 4704	4260	spoolsv.exe	158
PID 3248 set thread context of 1976	3248	spoolsv.exe	159
PID 2680 set thread context of 5440	2680	spoolsv.exe	161
PID 1964 set thread context of 5080	1964	spoolsv.exe	163
PID 2588 set thread context of 5312	2588	spoolsv.exe	164
PID 1460 set thread context of 3732	1460	spoolsv.exe	165
PID 1968 set thread context of 3200	1968	spoolsv.exe	168
PID 1880 set thread context of 5404	1880	spoolsv.exe	169
PID 2768 set thread context of 5512	2768	spoolsv.exe	170
PID 436 set thread context of 6136	436	spoolsv.exe	172
PID 1268 set thread context of 1856	1268	spoolsv.exe	174
PID 448 set thread context of 1328	448	spoolsv.exe	175
PID 2304 set thread context of 2280	2304	spoolsv.exe	176
PID 5192 set thread context of 5328	5192	spoolsv.exe	178
PID 5564 set thread context of 5352	5564	spoolsv.exe	182
PID 5692 set thread context of 4816	5692	explorer.exe	187
PID 6104 set thread context of 5520	6104	spoolsv.exe	189
PID 5760 set thread context of 5728	5760	explorer.exe	194
PID 6004 set thread context of 2104	6004	spoolsv.exe	197
PID 4640 set thread context of 1768	4640	explorer.exe	201
PID 1512 set thread context of 2776	1512	spoolsv.exe	203
PID 1500 set thread context of 4880	1500	explorer.exe	207
PID 1608 set thread context of 5392	1608	spoolsv.exe	209
PID 5308 set thread context of 2100	5308	spoolsv.exe	213
PID 1468 set thread context of 5908	1468	explorer.exe	215
PID 5892 set thread context of 5844	5892	spoolsv.exe	218
PID 4772 set thread context of 5684	4772	explorer.exe	220
PID 5504 set thread context of 5880	5504	spoolsv.exe	221
PID 3272 set thread context of 2708	3272	explorer.exe	222
PID 5856 set thread context of 2080	5856	spoolsv.exe	223
PID 5740 set thread context of 6076	5740	spoolsv.exe	224
PID 5360 set thread context of 5688	5360	explorer.exe	225
PID 1600 set thread context of 5808	1600	spoolsv.exe	226
PID 4884 set thread context of 4872	4884	spoolsv.exe	228
PID 5248 set thread context of 4036	5248	spoolsv.exe	231
PID 4104 set thread context of 1204	4104	spoolsv.exe	233
PID 2492 set thread context of 5732	2492	explorer.exe	234

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3888	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
3888	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1520	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3888	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
3888	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
1520	explorer.exe
5652	spoolsv.exe
5652	spoolsv.exe
5744	spoolsv.exe
5744	spoolsv.exe
3964	spoolsv.exe
3964	spoolsv.exe
5132	spoolsv.exe
5132	spoolsv.exe
5220	spoolsv.exe
5220	spoolsv.exe
5316	spoolsv.exe
5316	spoolsv.exe
5384	spoolsv.exe
5384	spoolsv.exe
5772	spoolsv.exe
5772	spoolsv.exe
5032	spoolsv.exe
5032	spoolsv.exe
5144	spoolsv.exe
5144	spoolsv.exe
736	spoolsv.exe
736	spoolsv.exe
5296	spoolsv.exe
5296	spoolsv.exe
3100	spoolsv.exe
3100	spoolsv.exe
5700	spoolsv.exe
5700	spoolsv.exe
4312	spoolsv.exe
4312	spoolsv.exe
5920	spoolsv.exe
5920	spoolsv.exe
3656	spoolsv.exe
3656	spoolsv.exe
4704	spoolsv.exe
4704	spoolsv.exe
1976	spoolsv.exe
1976	spoolsv.exe
5440	spoolsv.exe
5440	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
5312	spoolsv.exe
5312	spoolsv.exe
3732	spoolsv.exe
3732	spoolsv.exe
3200	spoolsv.exe
3200	spoolsv.exe
5404	spoolsv.exe
5404	spoolsv.exe
5512	spoolsv.exe
5512	spoolsv.exe
6136	spoolsv.exe
6136	spoolsv.exe
1856	spoolsv.exe
1856	spoolsv.exe
1328	spoolsv.exe
1328	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 5020	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	89
PID 3300 wrote to memory of 5020	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	89
PID 3300 wrote to memory of 3888	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	95
PID 3300 wrote to memory of 3888	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	95
PID 3300 wrote to memory of 3888	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	95
PID 3300 wrote to memory of 3888	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	95
PID 3300 wrote to memory of 3888	3300	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	95
PID 3888 wrote to memory of 4100	3888	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	96
PID 3888 wrote to memory of 4100	3888	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	96
PID 3888 wrote to memory of 4100	3888	a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe	96
PID 4100 wrote to memory of 1520	4100	explorer.exe	101
PID 4100 wrote to memory of 1520	4100	explorer.exe	101
PID 4100 wrote to memory of 1520	4100	explorer.exe	101
PID 4100 wrote to memory of 1520	4100	explorer.exe	101
PID 4100 wrote to memory of 1520	4100	explorer.exe	101
PID 1520 wrote to memory of 1672	1520	explorer.exe	102
PID 1520 wrote to memory of 1672	1520	explorer.exe	102
PID 1520 wrote to memory of 1672	1520	explorer.exe	102
PID 1520 wrote to memory of 4308	1520	explorer.exe	103
PID 1520 wrote to memory of 4308	1520	explorer.exe	103
PID 1520 wrote to memory of 4308	1520	explorer.exe	103
PID 1520 wrote to memory of 3308	1520	explorer.exe	104
PID 1520 wrote to memory of 3308	1520	explorer.exe	104
PID 1520 wrote to memory of 3308	1520	explorer.exe	104
PID 1520 wrote to memory of 3368	1520	explorer.exe	105
PID 1520 wrote to memory of 3368	1520	explorer.exe	105
PID 1520 wrote to memory of 3368	1520	explorer.exe	105
PID 1520 wrote to memory of 1256	1520	explorer.exe	106
PID 1520 wrote to memory of 1256	1520	explorer.exe	106
PID 1520 wrote to memory of 1256	1520	explorer.exe	106
PID 1520 wrote to memory of 5040	1520	explorer.exe	107
PID 1520 wrote to memory of 5040	1520	explorer.exe	107
PID 1520 wrote to memory of 5040	1520	explorer.exe	107
PID 1520 wrote to memory of 4904	1520	explorer.exe	109
PID 1520 wrote to memory of 4904	1520	explorer.exe	109
PID 1520 wrote to memory of 4904	1520	explorer.exe	109
PID 1520 wrote to memory of 4276	1520	explorer.exe	110
PID 1520 wrote to memory of 4276	1520	explorer.exe	110
PID 1520 wrote to memory of 4276	1520	explorer.exe	110
PID 1520 wrote to memory of 5112	1520	explorer.exe	111
PID 1520 wrote to memory of 5112	1520	explorer.exe	111
PID 1520 wrote to memory of 5112	1520	explorer.exe	111
PID 1520 wrote to memory of 4532	1520	explorer.exe	112
PID 1520 wrote to memory of 4532	1520	explorer.exe	112
PID 1520 wrote to memory of 4532	1520	explorer.exe	112
PID 1520 wrote to memory of 1244	1520	explorer.exe	113
PID 1520 wrote to memory of 1244	1520	explorer.exe	113
PID 1520 wrote to memory of 1244	1520	explorer.exe	113
PID 1520 wrote to memory of 4500	1520	explorer.exe	114
PID 1520 wrote to memory of 4500	1520	explorer.exe	114
PID 1520 wrote to memory of 4500	1520	explorer.exe	114
PID 1520 wrote to memory of 572	1520	explorer.exe	115
PID 1520 wrote to memory of 572	1520	explorer.exe	115
PID 1520 wrote to memory of 572	1520	explorer.exe	115
PID 1520 wrote to memory of 1956	1520	explorer.exe	116
PID 1520 wrote to memory of 1956	1520	explorer.exe	116
PID 1520 wrote to memory of 1956	1520	explorer.exe	116
PID 1520 wrote to memory of 3304	1520	explorer.exe	117
PID 1520 wrote to memory of 3304	1520	explorer.exe	117
PID 1520 wrote to memory of 3304	1520	explorer.exe	117
PID 1520 wrote to memory of 4480	1520	explorer.exe	118
PID 1520 wrote to memory of 4480	1520	explorer.exe	118
PID 1520 wrote to memory of 4480	1520	explorer.exe	118
PID 1520 wrote to memory of 412	1520	explorer.exe	119

C:\Users\Admin\AppData\Local\Temp\a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a87eb81d9f08c89d415d7ef98246fa70_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3888
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5652
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5692
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5772
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5760
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5700
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1500
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3732
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1468
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6136
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4772
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5328
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3272
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5360
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5520
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2492
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2104
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2100
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4872
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2372
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1380
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4808
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 5ab8d599b07d4ec7c50e1fec39884cf0d04b8378e24bdb30d0582c8967132d58
MD5 465e97c685333a17553f0947e84001da
SHA1 7ae2b7426c08c6cb69ce46641da9d9e5e6beadad
SHA512 0b8a1206fa26a359c0ff03dc4c5c6fc27b6fedaa110cdd83428f84caff548454e96f4ea05f60dcb11d1daa13e6f3b28fcf1c5fd44f5da1c0f842fd7e858f9e37
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWww3
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 56547afe82f472de8aa620a7367eb85b6e42da3955dd73c64002252c229ce876
MD5 4744eea9626400a7cb68700c0e711919
SHA1 6994661a2cf729e4a2fd0bbd0518543383109148
SHA512 16c589c3ebb093edd1411826bba6b47d66c32f0bb830cb193ebb6bd2c607f0a01a126d2330a1443cfedb5a702fecd867a715cd8b157c2c3f547091bec7a47a24
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ7:0UzeyQMS4DqodCnoe+iitjWww/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-1927-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/572-1720-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/736-2542-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1244-1718-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1256-1360-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1380-6198-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1460-2222-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-960-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1520-95-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1672-2214-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1672-961-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1768-4641-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1856-3294-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1956-1924-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1964-2211-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1976-2828-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2032-6039-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2080-5478-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2100-5209-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2100-5340-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2104-4422-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2104-4560-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2280-3314-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2280-3312-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2372-6031-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2372-6174-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2588-2212-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2680-2134-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2708-5472-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-4797-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-4889-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-5893-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-5891-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3100-2561-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3248-2133-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3300-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3300-0-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/3300-38-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/3300-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3304-1925-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3308-2312-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3308-1153-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3368-1154-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3656-2749-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3656-2746-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3732-3255-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3732-3028-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3888-39-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3888-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3888-84-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3964-2314-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4036-5784-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4100-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4100-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4260-2132-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4276-1583-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4308-2218-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4308-1152-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4312-2655-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-2658-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-1926-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4500-1719-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4532-1585-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4704-2756-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-3935-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4816-3938-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4872-5640-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4872-5752-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4880-4915-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4904-1362-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5032-2521-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5040-1361-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5080-2927-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-1584-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5132-2325-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5144-2533-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5220-2335-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5296-2552-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5316-2348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5328-3588-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5328-3464-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5352-3806-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5352-3693-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5384-2367-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5392-4999-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5404-3127-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5404-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5440-2839-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5440-2834-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5520-4095-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5520-3997-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5652-2213-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5652-2403-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5684-5449-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5688-5510-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5700-2647-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5700-2810-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5728-4265-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5732-5868-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5744-2224-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5744-2223-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/5772-2436-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5772-2612-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5844-5552-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5844-5439-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5880-5461-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5908-5217-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5920-2724-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6076-5492-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6136-3287-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6136-3437-0x0000000000400000-0x000000000043E000-memory.dmp

Download