pony | 233aa35e7bc043a66884e2d041b2615da00b39c41ff96c588d41672f5fac65fe

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
Size 2.2MB
Sample240614-p44hjs1fpb
SHA256 233aa35e7bc043a66884e2d041b2615da00b39c41ff96c588d41672f5fac65fe
MD5 a9c67fb90448279a2b60763f11b0c8eb
SHA1 f0eb1e1de5e916b0ab81a1f86915973b2506bd10
SHA512 4bc0a76e01b95ab33c8500d03f03cf925a1bdf3005219eb11dbe7af8e78dc8d71ab755fe19f7df809b15c8c6c4e24d7355207cdf23261722e5a864330f66f1da
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZe:0UzeyQMS4DqodCnoe+iitjWwwa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1820	explorer.exe
2384	explorer.exe
4952	spoolsv.exe
1920	spoolsv.exe
4028	spoolsv.exe
2600	spoolsv.exe
4520	spoolsv.exe
4984	spoolsv.exe
2612	spoolsv.exe
1288	spoolsv.exe
984	spoolsv.exe
1704	spoolsv.exe
2788	spoolsv.exe
1332	spoolsv.exe
2992	spoolsv.exe
4484	spoolsv.exe
4852	spoolsv.exe
2304	spoolsv.exe
544	spoolsv.exe
2156	spoolsv.exe
1236	spoolsv.exe
1520	spoolsv.exe
1076	spoolsv.exe
1716	spoolsv.exe
3628	spoolsv.exe
4420	spoolsv.exe
3732	spoolsv.exe
2340	spoolsv.exe
3496	spoolsv.exe
4724	spoolsv.exe
5196	spoolsv.exe
5564	spoolsv.exe
5624	spoolsv.exe
5668	explorer.exe
5752	spoolsv.exe
5824	spoolsv.exe
5916	spoolsv.exe
5296	spoolsv.exe
5360	spoolsv.exe
5404	explorer.exe
5448	spoolsv.exe
5544	spoolsv.exe
884	spoolsv.exe
1792	spoolsv.exe
5960	spoolsv.exe
5628	spoolsv.exe
6116	explorer.exe
5332	spoolsv.exe
5432	spoolsv.exe
5500	spoolsv.exe
5664	spoolsv.exe
5836	spoolsv.exe
2844	spoolsv.exe
5224	spoolsv.exe
2516	explorer.exe
6080	spoolsv.exe
5504	spoolsv.exe
2512	spoolsv.exe
5560	spoolsv.exe
5756	spoolsv.exe
4004	spoolsv.exe
2112	spoolsv.exe
3052	spoolsv.exe
4636	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 4872 set thread context of 3764	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	98
PID 1820 set thread context of 2384	1820	explorer.exe	107
PID 4952 set thread context of 5624	4952	spoolsv.exe	138
PID 1920 set thread context of 5752	1920	spoolsv.exe	140
PID 4028 set thread context of 5824	4028	spoolsv.exe	141
PID 2600 set thread context of 5916	2600	spoolsv.exe	142
PID 4520 set thread context of 5360	4520	spoolsv.exe	144
PID 4984 set thread context of 5448	4984	spoolsv.exe	146
PID 2612 set thread context of 5544	2612	spoolsv.exe	147
PID 1288 set thread context of 884	1288	spoolsv.exe	148
PID 984 set thread context of 5960	984	spoolsv.exe	150
PID 1704 set thread context of 5628	1704	spoolsv.exe	151
PID 2788 set thread context of 5332	2788	spoolsv.exe	153
PID 1332 set thread context of 5432	1332	spoolsv.exe	154
PID 2992 set thread context of 5500	2992	spoolsv.exe	155
PID 4484 set thread context of 5836	4484	spoolsv.exe	157
PID 4852 set thread context of 2844	4852	spoolsv.exe	158
PID 2304 set thread context of 5224	2304	spoolsv.exe	159
PID 544 set thread context of 6080	544	spoolsv.exe	161
PID 2156 set thread context of 2512	2156	spoolsv.exe	163
PID 1236 set thread context of 5560	1236	spoolsv.exe	164
PID 1520 set thread context of 5756	1520	spoolsv.exe	165
PID 1076 set thread context of 4004	1076	spoolsv.exe	166
PID 1716 set thread context of 2112	1716	spoolsv.exe	167
PID 3628 set thread context of 4636	3628	spoolsv.exe	169
PID 4420 set thread context of 5436	4420	spoolsv.exe	171
PID 3732 set thread context of 5600	3732	spoolsv.exe	172
PID 2340 set thread context of 5016	2340	spoolsv.exe	174
PID 3496 set thread context of 5188	3496	spoolsv.exe	176
PID 4724 set thread context of 5328	4724	spoolsv.exe	177
PID 5196 set thread context of 392	5196	spoolsv.exe	179
PID 5564 set thread context of 4412	5564	spoolsv.exe	183
PID 5668 set thread context of 6068	5668	explorer.exe	184
PID 5296 set thread context of 4912	5296	spoolsv.exe	188
PID 5404 set thread context of 5208	5404	explorer.exe	191
PID 1792 set thread context of 904	1792	spoolsv.exe	194
PID 6116 set thread context of 3056	6116	explorer.exe	197
PID 5664 set thread context of 5680	5664	spoolsv.exe	200
PID 2516 set thread context of 5248	2516	explorer.exe	205
PID 5504 set thread context of 5812	5504	spoolsv.exe	206
PID 5496 set thread context of 4448	5496	explorer.exe	210
PID 3052 set thread context of 2608	3052	spoolsv.exe	211
PID 3604 set thread context of 5412	3604	spoolsv.exe	215
PID 6044 set thread context of 5420	6044	explorer.exe	217
PID 5584 set thread context of 5508	5584	spoolsv.exe	218
PID 840 set thread context of 5356	840	explorer.exe	219
PID 2572 set thread context of 1020	2572	spoolsv.exe	220
PID 6104 set thread context of 4356	6104	spoolsv.exe	222
PID 5376 set thread context of 2768	5376	explorer.exe	224
PID 5828 set thread context of 2428	5828	spoolsv.exe	225
PID 1148 set thread context of 4704	1148	spoolsv.exe	228
PID 4320 set thread context of 5804	4320	spoolsv.exe	231
PID 1668 set thread context of 1964	1668	explorer.exe	232
PID 952 set thread context of 6092	952	spoolsv.exe	233
PID 4936 set thread context of 5388	4936	spoolsv.exe	236

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3764	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
3764	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2384	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3764	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
3764	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
2384	explorer.exe
5624	spoolsv.exe
5624	spoolsv.exe
5752	spoolsv.exe
5752	spoolsv.exe
5824	spoolsv.exe
5824	spoolsv.exe
5916	spoolsv.exe
5916	spoolsv.exe
5360	spoolsv.exe
5360	spoolsv.exe
5448	spoolsv.exe
5448	spoolsv.exe
5544	spoolsv.exe
5544	spoolsv.exe
884	spoolsv.exe
884	spoolsv.exe
5960	spoolsv.exe
5960	spoolsv.exe
5628	spoolsv.exe
5628	spoolsv.exe
5332	spoolsv.exe
5332	spoolsv.exe
5432	spoolsv.exe
5432	spoolsv.exe
5500	spoolsv.exe
5500	spoolsv.exe
5836	spoolsv.exe
5836	spoolsv.exe
2844	spoolsv.exe
2844	spoolsv.exe
5224	spoolsv.exe
5224	spoolsv.exe
6080	spoolsv.exe
6080	spoolsv.exe
2512	spoolsv.exe
2512	spoolsv.exe
5560	spoolsv.exe
5560	spoolsv.exe
5756	spoolsv.exe
5756	spoolsv.exe
4004	spoolsv.exe
4004	spoolsv.exe
2112	spoolsv.exe
2112	spoolsv.exe
4636	spoolsv.exe
4636	spoolsv.exe
5436	spoolsv.exe
5436	spoolsv.exe
5600	spoolsv.exe
5600	spoolsv.exe
5016	spoolsv.exe
5016	spoolsv.exe
5188	spoolsv.exe
5188	spoolsv.exe
5328	spoolsv.exe
5328	spoolsv.exe
392	spoolsv.exe
392	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3240	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	91
PID 4872 wrote to memory of 3240	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	91
PID 4872 wrote to memory of 3764	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	98
PID 4872 wrote to memory of 3764	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	98
PID 4872 wrote to memory of 3764	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	98
PID 4872 wrote to memory of 3764	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	98
PID 4872 wrote to memory of 3764	4872	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	98
PID 3764 wrote to memory of 1820	3764	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	99
PID 3764 wrote to memory of 1820	3764	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	99
PID 3764 wrote to memory of 1820	3764	a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe	99
PID 1820 wrote to memory of 2384	1820	explorer.exe	107
PID 1820 wrote to memory of 2384	1820	explorer.exe	107
PID 1820 wrote to memory of 2384	1820	explorer.exe	107
PID 1820 wrote to memory of 2384	1820	explorer.exe	107
PID 1820 wrote to memory of 2384	1820	explorer.exe	107
PID 2384 wrote to memory of 4952	2384	explorer.exe	108
PID 2384 wrote to memory of 4952	2384	explorer.exe	108
PID 2384 wrote to memory of 4952	2384	explorer.exe	108
PID 2384 wrote to memory of 1920	2384	explorer.exe	109
PID 2384 wrote to memory of 1920	2384	explorer.exe	109
PID 2384 wrote to memory of 1920	2384	explorer.exe	109
PID 2384 wrote to memory of 4028	2384	explorer.exe	110
PID 2384 wrote to memory of 4028	2384	explorer.exe	110
PID 2384 wrote to memory of 4028	2384	explorer.exe	110
PID 2384 wrote to memory of 2600	2384	explorer.exe	111
PID 2384 wrote to memory of 2600	2384	explorer.exe	111
PID 2384 wrote to memory of 2600	2384	explorer.exe	111
PID 2384 wrote to memory of 4520	2384	explorer.exe	112
PID 2384 wrote to memory of 4520	2384	explorer.exe	112
PID 2384 wrote to memory of 4520	2384	explorer.exe	112
PID 2384 wrote to memory of 4984	2384	explorer.exe	113
PID 2384 wrote to memory of 4984	2384	explorer.exe	113
PID 2384 wrote to memory of 4984	2384	explorer.exe	113
PID 2384 wrote to memory of 2612	2384	explorer.exe	114
PID 2384 wrote to memory of 2612	2384	explorer.exe	114
PID 2384 wrote to memory of 2612	2384	explorer.exe	114
PID 2384 wrote to memory of 1288	2384	explorer.exe	115
PID 2384 wrote to memory of 1288	2384	explorer.exe	115
PID 2384 wrote to memory of 1288	2384	explorer.exe	115
PID 2384 wrote to memory of 984	2384	explorer.exe	116
PID 2384 wrote to memory of 984	2384	explorer.exe	116
PID 2384 wrote to memory of 984	2384	explorer.exe	116
PID 2384 wrote to memory of 1704	2384	explorer.exe	117
PID 2384 wrote to memory of 1704	2384	explorer.exe	117
PID 2384 wrote to memory of 1704	2384	explorer.exe	117
PID 2384 wrote to memory of 2788	2384	explorer.exe	118
PID 2384 wrote to memory of 2788	2384	explorer.exe	118
PID 2384 wrote to memory of 2788	2384	explorer.exe	118
PID 2384 wrote to memory of 1332	2384	explorer.exe	119
PID 2384 wrote to memory of 1332	2384	explorer.exe	119
PID 2384 wrote to memory of 1332	2384	explorer.exe	119
PID 2384 wrote to memory of 2992	2384	explorer.exe	120
PID 2384 wrote to memory of 2992	2384	explorer.exe	120
PID 2384 wrote to memory of 2992	2384	explorer.exe	120
PID 2384 wrote to memory of 4484	2384	explorer.exe	121
PID 2384 wrote to memory of 4484	2384	explorer.exe	121
PID 2384 wrote to memory of 4484	2384	explorer.exe	121
PID 2384 wrote to memory of 4852	2384	explorer.exe	122
PID 2384 wrote to memory of 4852	2384	explorer.exe	122
PID 2384 wrote to memory of 4852	2384	explorer.exe	122
PID 2384 wrote to memory of 2304	2384	explorer.exe	123
PID 2384 wrote to memory of 2304	2384	explorer.exe	123
PID 2384 wrote to memory of 2304	2384	explorer.exe	123
PID 2384 wrote to memory of 544	2384	explorer.exe	124

C:\Users\Admin\AppData\Local\Temp\a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3240
- C:\Users\Admin\AppData\Local\Temp\a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a9c67fb90448279a2b60763f11b0c8eb_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3764
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5624
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5668
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5360
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5404
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6116
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5224
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2516
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1716
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:5496
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5016
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6044
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:392
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:840
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5376
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1668
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5680
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5812
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5412
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4356
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4704
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5388
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1960,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 a4d37e1aa8048e67b6f4a7a24fc8efbfa46d04c995f8fbc14066cbe0dff8fd89
MD5 81b175480f464578ca93fa77d01ec7d7
SHA1 0d8488c924394d7c4ef682f265d40fd25417aefc
SHA512 2025009bfc3069e3ef1dca9a17b1d82dcb26091ad701c202e94b05d56c4093ddad3fa99733aeeb156d4153759a8d6cdaa7178b4f362c83da4f5e75a85f21cdb9
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWww9
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 e1cf446a85cb2a418d37b9ed6ab30d495d18f0b06e46745485a9a9e3e26a0cac
MD5 990b07b46af3b94e6009e4f137c4bb68
SHA1 83e20b49031ce3bc73604af40e042e16c42a84e9
SHA512 bb1ebc6ba6a947e70def02cf9acb821ac5b3e5b8e06d396155539ce20206d1b42182071bd684c050fa6f0f5c4e8306bd25f50270ac019b9b63ebd72b84bb2404
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-3053-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/392-3158-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/544-1828-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/884-2148-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/904-3628-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/904-3711-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/984-1328-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1020-4559-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1076-1997-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1236-1972-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1288-1327-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1332-1503-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1520-1978-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1704-1501-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1716-1998-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1820-100-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1820-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1920-1982-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1920-1046-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1964-4949-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2112-2616-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2112-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2156-1971-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2304-1827-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2384-864-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2384-104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2428-4679-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2428-4689-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2512-2582-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2600-1048-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2600-2007-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2608-4366-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2608-4267-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2612-1186-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2768-4664-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2788-1502-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2844-2426-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2992-1692-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3056-3791-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-2005-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3764-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3764-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3764-87-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/3764-89-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4028-1047-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4028-1995-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4356-4654-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4412-3251-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4412-3380-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4448-4261-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-1698-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4520-1184-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4636-2780-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-2835-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4704-5051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4704-4842-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4852-1699-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4872-0-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/4872-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4872-43-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/4872-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4912-3452-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4912-3566-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-865-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4952-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4984-1185-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5016-2936-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5188-2945-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5208-3510-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5224-2513-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5248-4102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5328-2956-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5332-2307-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5332-2311-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5356-4486-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5360-2280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5360-2121-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5388-5130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5412-4643-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5412-4456-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5420-4465-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5432-2319-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5436-2791-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5436-2787-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5448-2129-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5500-2329-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5500-2333-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5508-4475-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5544-2138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5600-2799-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5624-2101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5624-1973-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5628-2495-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5628-2298-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5680-3883-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5752-1985-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5804-4938-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5812-4207-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5824-1993-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5836-2416-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5916-2006-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5916-2009-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5960-2243-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6068-3258-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6080-2524-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6092-4959-0x0000000000400000-0x000000000043E000-memory.dmp

Download