pony | 87c674ec6703c0198e805140ec5f88039188613f547e8128f74f0a1d03a38f5b

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
Size 2.2MB
Sample240614-pcw96azflc
SHA256 87c674ec6703c0198e805140ec5f88039188613f547e8128f74f0a1d03a38f5b
MD5 a99c6f3b42c2ebd29cd5bc044708ca17
SHA1 f5bfd0a5d74e7460e1354870114e19b20c999e72
SHA512 5cfe648250d265d3eabbb34986d173de73af7de484019fc9451c5f0d750daf87d2f03b4abdb09f7d9d6000cd8237cbb5eece8e8be5fdfdc3f84c1b5fadca4d84
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZN:0UzeyQMS4DqodCnoe+iitjWww5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4216	explorer.exe
1184	explorer.exe
2664	spoolsv.exe
4460	spoolsv.exe
2408	spoolsv.exe
1992	spoolsv.exe
2688	spoolsv.exe
1792	spoolsv.exe
4476	spoolsv.exe
4040	spoolsv.exe
1160	spoolsv.exe
3224	spoolsv.exe
1512	spoolsv.exe
4120	spoolsv.exe
1964	spoolsv.exe
2136	spoolsv.exe
3692	spoolsv.exe
3908	spoolsv.exe
4068	spoolsv.exe
2904	spoolsv.exe
1380	spoolsv.exe
1836	spoolsv.exe
4136	spoolsv.exe
4456	spoolsv.exe
3376	spoolsv.exe
4248	spoolsv.exe
884	spoolsv.exe
4924	spoolsv.exe
3668	spoolsv.exe
1084	spoolsv.exe
3328	spoolsv.exe
4916	spoolsv.exe
3696	spoolsv.exe
4440	spoolsv.exe
3444	explorer.exe
2976	spoolsv.exe
4300	spoolsv.exe
4508	spoolsv.exe
3708	spoolsv.exe
3560	spoolsv.exe
2880	explorer.exe
3516	spoolsv.exe
3788	spoolsv.exe
2304	spoolsv.exe
868	spoolsv.exe
4420	spoolsv.exe
3972	spoolsv.exe
3856	spoolsv.exe
1756	explorer.exe
4576	spoolsv.exe
4240	spoolsv.exe
3092	spoolsv.exe
4192	spoolsv.exe
644	spoolsv.exe
3576	spoolsv.exe
4144	spoolsv.exe
5000	explorer.exe
4752	spoolsv.exe
1156	spoolsv.exe
1232	spoolsv.exe
4960	spoolsv.exe
1356	spoolsv.exe
4304	spoolsv.exe
4780	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 1492	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	87
PID 4216 set thread context of 1184	4216	explorer.exe	96
PID 2664 set thread context of 4440	2664	spoolsv.exe	128
PID 4460 set thread context of 2976	4460	spoolsv.exe	130
PID 2408 set thread context of 4300	2408	spoolsv.exe	131
PID 1992 set thread context of 4508	1992	spoolsv.exe	132
PID 2688 set thread context of 3560	2688	spoolsv.exe	134
PID 1792 set thread context of 3516	1792	spoolsv.exe	136
PID 4476 set thread context of 3788	4476	spoolsv.exe	137
PID 4040 set thread context of 2304	4040	spoolsv.exe	138
PID 1160 set thread context of 868	1160	spoolsv.exe	139
PID 3224 set thread context of 3972	3224	spoolsv.exe	141
PID 1512 set thread context of 3856	1512	spoolsv.exe	142
PID 4120 set thread context of 4576	4120	spoolsv.exe	144
PID 1964 set thread context of 4240	1964	spoolsv.exe	145
PID 2136 set thread context of 3092	2136	spoolsv.exe	146
PID 3692 set thread context of 644	3692	spoolsv.exe	148
PID 3908 set thread context of 3576	3908	spoolsv.exe	149
PID 4068 set thread context of 4144	4068	spoolsv.exe	150
PID 2904 set thread context of 4752	2904	spoolsv.exe	152
PID 1380 set thread context of 1156	1380	spoolsv.exe	153
PID 1836 set thread context of 4960	1836	spoolsv.exe	155
PID 4136 set thread context of 1356	4136	spoolsv.exe	156
PID 4456 set thread context of 4304	4456	spoolsv.exe	157
PID 3376 set thread context of 4780	3376	spoolsv.exe	158
PID 4248 set thread context of 1112	4248	spoolsv.exe	160
PID 884 set thread context of 816	884	spoolsv.exe	162
PID 4924 set thread context of 3144	4924	spoolsv.exe	163
PID 3668 set thread context of 4616	3668	spoolsv.exe	164
PID 1084 set thread context of 3628	1084	spoolsv.exe	165
PID 3328 set thread context of 4976	3328	spoolsv.exe	168
PID 4916 set thread context of 1272	4916	spoolsv.exe	169
PID 3444 set thread context of 3896	3444	explorer.exe	172
PID 3696 set thread context of 2248	3696	spoolsv.exe	173
PID 3708 set thread context of 2552	3708	spoolsv.exe	179
PID 2880 set thread context of 4484	2880	explorer.exe	181
PID 4420 set thread context of 1568	4420	spoolsv.exe	185
PID 1756 set thread context of 4480	1756	explorer.exe	188
PID 4192 set thread context of 1384	4192	spoolsv.exe	192
PID 5000 set thread context of 4928	5000	explorer.exe	196
PID 1232 set thread context of 1092	1232	spoolsv.exe	199
PID 1460 set thread context of 264	1460	explorer.exe	204
PID 1548 set thread context of 896	1548	spoolsv.exe	205
PID 4568 set thread context of 1096	4568	explorer.exe	208
PID 4000 set thread context of 2308	4000	spoolsv.exe	209
PID 4028 set thread context of 5104	4028	spoolsv.exe	212
PID 4892 set thread context of 4736	4892	spoolsv.exe	214
PID 4372 set thread context of 1636	4372	explorer.exe	216
PID 1008 set thread context of 440	1008	spoolsv.exe	217
PID 1576 set thread context of 552	1576	spoolsv.exe	218
PID 1108 set thread context of 2484	1108	spoolsv.exe	220
PID 1896 set thread context of 4824	1896	spoolsv.exe	221
PID 3108 set thread context of 4368	3108	explorer.exe	223
PID 2668 set thread context of 4588	2668	spoolsv.exe	225
PID 2240 set thread context of 2656	2240	spoolsv.exe	226

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1492	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
1492	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1184	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1492	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
1492	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
1184	explorer.exe
4440	spoolsv.exe
4440	spoolsv.exe
2976	spoolsv.exe
2976	spoolsv.exe
4300	spoolsv.exe
4300	spoolsv.exe
4508	spoolsv.exe
4508	spoolsv.exe
3560	spoolsv.exe
3560	spoolsv.exe
3516	spoolsv.exe
3516	spoolsv.exe
3788	spoolsv.exe
3788	spoolsv.exe
2304	spoolsv.exe
2304	spoolsv.exe
868	spoolsv.exe
868	spoolsv.exe
3972	spoolsv.exe
3972	spoolsv.exe
3856	spoolsv.exe
3856	spoolsv.exe
4576	spoolsv.exe
4576	spoolsv.exe
4240	spoolsv.exe
4240	spoolsv.exe
3092	spoolsv.exe
3092	spoolsv.exe
644	spoolsv.exe
644	spoolsv.exe
3576	spoolsv.exe
3576	spoolsv.exe
4144	spoolsv.exe
4144	spoolsv.exe
4752	spoolsv.exe
4752	spoolsv.exe
1156	spoolsv.exe
1156	spoolsv.exe
4960	spoolsv.exe
4960	spoolsv.exe
1356	spoolsv.exe
1356	spoolsv.exe
4304	spoolsv.exe
4304	spoolsv.exe
4780	spoolsv.exe
4780	spoolsv.exe
1112	spoolsv.exe
1112	spoolsv.exe
816	spoolsv.exe
816	spoolsv.exe
3144	spoolsv.exe
3144	spoolsv.exe
4616	spoolsv.exe
4616	spoolsv.exe
3628	spoolsv.exe
3628	spoolsv.exe
4976	spoolsv.exe
4976	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 232	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	82
PID 2312 wrote to memory of 232	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	82
PID 2312 wrote to memory of 1492	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	87
PID 2312 wrote to memory of 1492	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	87
PID 2312 wrote to memory of 1492	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	87
PID 2312 wrote to memory of 1492	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	87
PID 2312 wrote to memory of 1492	2312	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	87
PID 1492 wrote to memory of 4216	1492	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	88
PID 1492 wrote to memory of 4216	1492	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	88
PID 1492 wrote to memory of 4216	1492	a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe	88
PID 4216 wrote to memory of 1184	4216	explorer.exe	96
PID 4216 wrote to memory of 1184	4216	explorer.exe	96
PID 4216 wrote to memory of 1184	4216	explorer.exe	96
PID 4216 wrote to memory of 1184	4216	explorer.exe	96
PID 4216 wrote to memory of 1184	4216	explorer.exe	96
PID 1184 wrote to memory of 2664	1184	explorer.exe	97
PID 1184 wrote to memory of 2664	1184	explorer.exe	97
PID 1184 wrote to memory of 2664	1184	explorer.exe	97
PID 1184 wrote to memory of 4460	1184	explorer.exe	98
PID 1184 wrote to memory of 4460	1184	explorer.exe	98
PID 1184 wrote to memory of 4460	1184	explorer.exe	98
PID 1184 wrote to memory of 2408	1184	explorer.exe	99
PID 1184 wrote to memory of 2408	1184	explorer.exe	99
PID 1184 wrote to memory of 2408	1184	explorer.exe	99
PID 1184 wrote to memory of 1992	1184	explorer.exe	100
PID 1184 wrote to memory of 1992	1184	explorer.exe	100
PID 1184 wrote to memory of 1992	1184	explorer.exe	100
PID 1184 wrote to memory of 2688	1184	explorer.exe	101
PID 1184 wrote to memory of 2688	1184	explorer.exe	101
PID 1184 wrote to memory of 2688	1184	explorer.exe	101
PID 1184 wrote to memory of 1792	1184	explorer.exe	102
PID 1184 wrote to memory of 1792	1184	explorer.exe	102
PID 1184 wrote to memory of 1792	1184	explorer.exe	102
PID 1184 wrote to memory of 4476	1184	explorer.exe	103
PID 1184 wrote to memory of 4476	1184	explorer.exe	103
PID 1184 wrote to memory of 4476	1184	explorer.exe	103
PID 1184 wrote to memory of 4040	1184	explorer.exe	104
PID 1184 wrote to memory of 4040	1184	explorer.exe	104
PID 1184 wrote to memory of 4040	1184	explorer.exe	104
PID 1184 wrote to memory of 1160	1184	explorer.exe	105
PID 1184 wrote to memory of 1160	1184	explorer.exe	105
PID 1184 wrote to memory of 1160	1184	explorer.exe	105
PID 1184 wrote to memory of 3224	1184	explorer.exe	106
PID 1184 wrote to memory of 3224	1184	explorer.exe	106
PID 1184 wrote to memory of 3224	1184	explorer.exe	106
PID 1184 wrote to memory of 1512	1184	explorer.exe	107
PID 1184 wrote to memory of 1512	1184	explorer.exe	107
PID 1184 wrote to memory of 1512	1184	explorer.exe	107
PID 1184 wrote to memory of 4120	1184	explorer.exe	108
PID 1184 wrote to memory of 4120	1184	explorer.exe	108
PID 1184 wrote to memory of 4120	1184	explorer.exe	108
PID 1184 wrote to memory of 1964	1184	explorer.exe	109
PID 1184 wrote to memory of 1964	1184	explorer.exe	109
PID 1184 wrote to memory of 1964	1184	explorer.exe	109
PID 1184 wrote to memory of 2136	1184	explorer.exe	110
PID 1184 wrote to memory of 2136	1184	explorer.exe	110
PID 1184 wrote to memory of 2136	1184	explorer.exe	110
PID 1184 wrote to memory of 3692	1184	explorer.exe	111
PID 1184 wrote to memory of 3692	1184	explorer.exe	111
PID 1184 wrote to memory of 3692	1184	explorer.exe	111
PID 1184 wrote to memory of 3908	1184	explorer.exe	112
PID 1184 wrote to memory of 3908	1184	explorer.exe	112
PID 1184 wrote to memory of 3908	1184	explorer.exe	112
PID 1184 wrote to memory of 4068	1184	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:232
- C:\Users\Admin\AppData\Local\Temp\a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a99c6f3b42c2ebd29cd5bc044708ca17_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1492
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4440
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3444
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2880
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1756
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4144
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5000
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4780
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1460
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1084
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4568
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4372
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2552
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3108
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1568
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1384
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:896
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4736
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4824
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5072
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:8
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 a21cb137a4d57d2f05b487b97305888ba45f2417ac0e7cd56532883d8c390046
MD5 26999fef21f0ee5128bf1aff1ceeee76
SHA1 4c310c054fc048fe1b683df6c258411ceb90a8d9
SHA512 33559dbea63df407ba1050c6fb6f8fea00b9a7011ce3ccaef1dcf435a1acb4ab70f1841f081f4974aa0f62666a99381bc149025b96799ad5cc1b144eda9210d6
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwww
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 98c960eadbcad21c5d2e770b8482e611ccc58cd5d75ae6f78e62a96475a1f31a
MD5 9d3ae5e7b32c942f483c3b22961d36e6
SHA1 76170547747c0a7e98a25c430d9912ebee55281e
SHA512 9d2bd0dc246b7e408a07bf2f73513bac69b19af0fb1c1e6a18dde28dfcdc88f35e41e759073d7a329ac217af9e6299da6c7a15ed68f3d79ff4513e503b9bef28
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWww4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/264-4762-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/552-5171-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/644-2517-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/868-2275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/868-2270-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/896-4772-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/896-4870-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1092-4623-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1092-4505-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1096-4904-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1156-2629-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1160-1419-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1184-80-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1184-900-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1272-3083-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1356-2728-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1356-2731-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1380-2028-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1384-4277-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1384-4169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1492-26-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1492-62-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1492-64-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1492-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1512-1588-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1568-3827-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1636-5121-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1792-1231-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1836-2029-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1964-1752-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1992-2059-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1992-1039-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2136-1753-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2248-3367-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2304-2261-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2308-5042-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2308-4898-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2312-0-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/2312-28-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2312-23-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/2312-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2408-1038-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2408-2051-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2484-5206-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2552-3563-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2552-3698-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2664-901-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2664-2031-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2688-1230-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2904-1905-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2976-2039-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3092-2438-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3144-2915-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3144-2911-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3224-1420-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3376-2060-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3516-2239-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3560-2229-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3576-2589-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3628-3155-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3692-1754-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3788-2249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3856-2587-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3856-2406-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3896-3241-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3908-1903-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3972-2343-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4040-1418-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4068-1904-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4120-1589-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4136-2038-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4144-2612-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4216-81-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4216-75-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4240-2427-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4300-2050-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4304-2754-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4368-5281-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4440-2131-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4440-2030-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4456-2049-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4460-2040-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4460-1037-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4476-1232-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4480-3971-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4484-3576-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4508-2062-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4576-2414-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4588-5369-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4616-2924-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4736-5104-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4736-5250-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4752-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4780-2802-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4780-2972-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4824-5271-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4824-5412-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4928-4386-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4960-2718-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-3071-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5104-4993-0x0000000000400000-0x000000000043E000-memory.dmp

Download