pony | 4a3d8c3a1e835a77f0ac47776d9551faf0a028274b88f9afb934f8ecc9de1c10

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
Size

2.2MB
MD5

aa43a6a9f348d86955e3482c7ca2b8a5
SHA1

5389663967caf73ed59246c9bcd2d5984a6c0eba
SHA256

4a3d8c3a1e835a77f0ac47776d9551faf0a028274b88f9afb934f8ecc9de1c10
SHA512

91ded2ae613bdfc6954f1721284a7fd4ce7ae342a9ca55ca7770bc6b3b91b023e6e54cb640c2c34616c45f438b2900486a02beccef09c7a7aa0525cbfea2c1c9
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZW:0UzeyQMS4DqodCnoe+iitjWwwC

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
3948	explorer.exe
1300	explorer.exe
1588	spoolsv.exe
232	spoolsv.exe
3644	spoolsv.exe
1748	spoolsv.exe
564	spoolsv.exe
3500	spoolsv.exe
5088	spoolsv.exe
2188	spoolsv.exe
856	spoolsv.exe
1224	spoolsv.exe
3920	spoolsv.exe
5108	spoolsv.exe
2860	spoolsv.exe
3840	spoolsv.exe
1548	spoolsv.exe
872	spoolsv.exe
1100	spoolsv.exe
3552	spoolsv.exe
4040	spoolsv.exe
4392	spoolsv.exe
2344	spoolsv.exe
3036	spoolsv.exe
416	spoolsv.exe
3744	spoolsv.exe
3180	spoolsv.exe
3368	spoolsv.exe
4180	spoolsv.exe
2308	spoolsv.exe
4840	spoolsv.exe
3196	spoolsv.exe
5004	spoolsv.exe
3676	explorer.exe
3780	spoolsv.exe
4588	spoolsv.exe
4956	spoolsv.exe
4384	spoolsv.exe
408	spoolsv.exe
1528	spoolsv.exe
352	spoolsv.exe
2248	spoolsv.exe
2804	explorer.exe
3568	spoolsv.exe
4772	spoolsv.exe
4304	spoolsv.exe
4920	spoolsv.exe
1060	spoolsv.exe
3052	explorer.exe
2608	spoolsv.exe
3752	spoolsv.exe
1552	spoolsv.exe
4648	spoolsv.exe
5020	spoolsv.exe
2808	explorer.exe
1500	spoolsv.exe
1344	spoolsv.exe
4196	spoolsv.exe
1708	spoolsv.exe
3008	spoolsv.exe
3324	explorer.exe
560	spoolsv.exe
1920	spoolsv.exe
1272	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 540 set thread context of 4740	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	87
PID 3948 set thread context of 1300	3948	explorer.exe	96
PID 1588 set thread context of 5004	1588	spoolsv.exe	127
PID 232 set thread context of 4588	232	spoolsv.exe	130
PID 3644 set thread context of 4956	3644	spoolsv.exe	131
PID 1748 set thread context of 4384	1748	spoolsv.exe	132
PID 564 set thread context of 408	564	spoolsv.exe	133
PID 3500 set thread context of 1528	3500	spoolsv.exe	134
PID 5088 set thread context of 2248	5088	spoolsv.exe	136
PID 2188 set thread context of 3568	2188	spoolsv.exe	138
PID 856 set thread context of 4772	856	spoolsv.exe	139
PID 1224 set thread context of 4304	1224	spoolsv.exe	140
PID 3920 set thread context of 1060	3920	spoolsv.exe	142
PID 5108 set thread context of 2608	5108	spoolsv.exe	144
PID 2860 set thread context of 3752	2860	spoolsv.exe	145
PID 3840 set thread context of 1552	3840	spoolsv.exe	146
PID 1548 set thread context of 5020	1548	spoolsv.exe	148
PID 872 set thread context of 1500	872	spoolsv.exe	150
PID 1100 set thread context of 1344	1100	spoolsv.exe	151
PID 3552 set thread context of 4196	3552	spoolsv.exe	152
PID 4040 set thread context of 3008	4040	spoolsv.exe	154
PID 4392 set thread context of 560	4392	spoolsv.exe	156
PID 2344 set thread context of 1920	2344	spoolsv.exe	157
PID 3036 set thread context of 1272	3036	spoolsv.exe	158
PID 416 set thread context of 1012	416	spoolsv.exe	159
PID 3744 set thread context of 4168	3744	spoolsv.exe	160
PID 3180 set thread context of 4892	3180	spoolsv.exe	162
PID 3368 set thread context of 4428	3368	spoolsv.exe	164
PID 4180 set thread context of 2544	4180	spoolsv.exe	165
PID 2308 set thread context of 472	2308	spoolsv.exe	166
PID 4840 set thread context of 2852	4840	spoolsv.exe	168
PID 3196 set thread context of 1164	3196	spoolsv.exe	171
PID 3676 set thread context of 2688	3676	explorer.exe	176
PID 3780 set thread context of 4436	3780	spoolsv.exe	177
PID 352 set thread context of 2088	352	spoolsv.exe	181
PID 2804 set thread context of 2136	2804	explorer.exe	183
PID 3052 set thread context of 3976	3052	explorer.exe	185
PID 4920 set thread context of 4344	4920	spoolsv.exe	186
PID 4648 set thread context of 1776	4648	spoolsv.exe	191
PID 2808 set thread context of 5008	2808	explorer.exe	193
PID 3324 set thread context of 516	3324	explorer.exe	196
PID 1708 set thread context of 2548	1708	spoolsv.exe	197
PID 1364 set thread context of 1680	1364	spoolsv.exe	201
PID 2696 set thread context of 1580	2696	explorer.exe	203
PID 3192 set thread context of 4356	3192	spoolsv.exe	205
PID 3220 set thread context of 3096	3220	explorer.exe	206
PID 4288 set thread context of 4064	4288	spoolsv.exe	207
PID 2464 set thread context of 2260	2464	explorer.exe	208
PID 4560 set thread context of 4400	4560	spoolsv.exe	210
PID 3572 set thread context of 1028	3572	spoolsv.exe	212
PID 2080 set thread context of 2408	2080	spoolsv.exe	214
PID 3624 set thread context of 2300	3624	explorer.exe	216
PID 3956 set thread context of 5032	3956	spoolsv.exe	218
PID 1432 set thread context of 3080	1432	spoolsv.exe	221
PID 1932 set thread context of 2340	1932	explorer.exe	224

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4740	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
4740	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1300	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4740	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
4740	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
1300	explorer.exe
5004	spoolsv.exe
5004	spoolsv.exe
4588	spoolsv.exe
4588	spoolsv.exe
4956	spoolsv.exe
4956	spoolsv.exe
4384	spoolsv.exe
4384	spoolsv.exe
408	spoolsv.exe
408	spoolsv.exe
1528	spoolsv.exe
1528	spoolsv.exe
2248	spoolsv.exe
2248	spoolsv.exe
3568	spoolsv.exe
3568	spoolsv.exe
4772	spoolsv.exe
4772	spoolsv.exe
4304	spoolsv.exe
4304	spoolsv.exe
1060	spoolsv.exe
1060	spoolsv.exe
2608	spoolsv.exe
2608	spoolsv.exe
3752	spoolsv.exe
3752	spoolsv.exe
1552	spoolsv.exe
1552	spoolsv.exe
5020	spoolsv.exe
5020	spoolsv.exe
1500	spoolsv.exe
1500	spoolsv.exe
1344	spoolsv.exe
1344	spoolsv.exe
4196	spoolsv.exe
4196	spoolsv.exe
3008	spoolsv.exe
3008	spoolsv.exe
560	spoolsv.exe
560	spoolsv.exe
1920	spoolsv.exe
1920	spoolsv.exe
1272	spoolsv.exe
1272	spoolsv.exe
1012	spoolsv.exe
1012	spoolsv.exe
4168	spoolsv.exe
4168	spoolsv.exe
4892	spoolsv.exe
4892	spoolsv.exe
4428	spoolsv.exe
4428	spoolsv.exe
2544	spoolsv.exe
2544	spoolsv.exe
472	spoolsv.exe
472	spoolsv.exe
2852	spoolsv.exe
2852	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1816	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	83
PID 540 wrote to memory of 1816	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	83
PID 540 wrote to memory of 4740	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	87
PID 540 wrote to memory of 4740	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	87
PID 540 wrote to memory of 4740	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	87
PID 540 wrote to memory of 4740	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	87
PID 540 wrote to memory of 4740	540	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	87
PID 4740 wrote to memory of 3948	4740	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	88
PID 4740 wrote to memory of 3948	4740	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	88
PID 4740 wrote to memory of 3948	4740	aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe	88
PID 3948 wrote to memory of 1300	3948	explorer.exe	96
PID 3948 wrote to memory of 1300	3948	explorer.exe	96
PID 3948 wrote to memory of 1300	3948	explorer.exe	96
PID 3948 wrote to memory of 1300	3948	explorer.exe	96
PID 3948 wrote to memory of 1300	3948	explorer.exe	96
PID 1300 wrote to memory of 1588	1300	explorer.exe	97
PID 1300 wrote to memory of 1588	1300	explorer.exe	97
PID 1300 wrote to memory of 1588	1300	explorer.exe	97
PID 1300 wrote to memory of 232	1300	explorer.exe	98
PID 1300 wrote to memory of 232	1300	explorer.exe	98
PID 1300 wrote to memory of 232	1300	explorer.exe	98
PID 1300 wrote to memory of 3644	1300	explorer.exe	99
PID 1300 wrote to memory of 3644	1300	explorer.exe	99
PID 1300 wrote to memory of 3644	1300	explorer.exe	99
PID 1300 wrote to memory of 1748	1300	explorer.exe	100
PID 1300 wrote to memory of 1748	1300	explorer.exe	100
PID 1300 wrote to memory of 1748	1300	explorer.exe	100
PID 1300 wrote to memory of 564	1300	explorer.exe	101
PID 1300 wrote to memory of 564	1300	explorer.exe	101
PID 1300 wrote to memory of 564	1300	explorer.exe	101
PID 1300 wrote to memory of 3500	1300	explorer.exe	102
PID 1300 wrote to memory of 3500	1300	explorer.exe	102
PID 1300 wrote to memory of 3500	1300	explorer.exe	102
PID 1300 wrote to memory of 5088	1300	explorer.exe	103
PID 1300 wrote to memory of 5088	1300	explorer.exe	103
PID 1300 wrote to memory of 5088	1300	explorer.exe	103
PID 1300 wrote to memory of 2188	1300	explorer.exe	104
PID 1300 wrote to memory of 2188	1300	explorer.exe	104
PID 1300 wrote to memory of 2188	1300	explorer.exe	104
PID 1300 wrote to memory of 856	1300	explorer.exe	105
PID 1300 wrote to memory of 856	1300	explorer.exe	105
PID 1300 wrote to memory of 856	1300	explorer.exe	105
PID 1300 wrote to memory of 1224	1300	explorer.exe	106
PID 1300 wrote to memory of 1224	1300	explorer.exe	106
PID 1300 wrote to memory of 1224	1300	explorer.exe	106
PID 1300 wrote to memory of 3920	1300	explorer.exe	107
PID 1300 wrote to memory of 3920	1300	explorer.exe	107
PID 1300 wrote to memory of 3920	1300	explorer.exe	107
PID 1300 wrote to memory of 5108	1300	explorer.exe	108
PID 1300 wrote to memory of 5108	1300	explorer.exe	108
PID 1300 wrote to memory of 5108	1300	explorer.exe	108
PID 1300 wrote to memory of 2860	1300	explorer.exe	109
PID 1300 wrote to memory of 2860	1300	explorer.exe	109
PID 1300 wrote to memory of 2860	1300	explorer.exe	109
PID 1300 wrote to memory of 3840	1300	explorer.exe	110
PID 1300 wrote to memory of 3840	1300	explorer.exe	110
PID 1300 wrote to memory of 3840	1300	explorer.exe	110
PID 1300 wrote to memory of 1548	1300	explorer.exe	111
PID 1300 wrote to memory of 1548	1300	explorer.exe	111
PID 1300 wrote to memory of 1548	1300	explorer.exe	111
PID 1300 wrote to memory of 872	1300	explorer.exe	112
PID 1300 wrote to memory of 872	1300	explorer.exe	112
PID 1300 wrote to memory of 872	1300	explorer.exe	112
PID 1300 wrote to memory of 1100	1300	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\aa43a6a9f348d86955e3482c7ca2b8a5_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4740
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3676
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2804
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3052
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2808
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3324
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2696
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4180
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3220
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1164
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2464
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:3624
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:352
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1932
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4344
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2548
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1680
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2408
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5032
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3080
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
30d47f2c8bc7e6d17b65d6af5fde9d02

SHA1
13ab7ca0cadcd4c2a28b5be0db8fc09757ddc359

SHA256
14654d2262bea7af1ce98a62976d617be808cb27fb270812f1ac35154ac51ac9

SHA512
ee6d0b4d0df3889100e5a15a2449859d9c3f8dc941d0a8317907b6c9d5f3f66eab827dafc5a5cfd4b7794d86ef4b9fce75db9327a1ecc6fbdf377287de8f5461

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
24a51cc23588dd5a80896dc5be91e450

SHA1
c43c223fe6fc203f0057e71853f108d926ab5b7b

SHA256
6e91e6988ccf3d07fef9fec610033f8e520c582e3137fef712202fd155f5632e

SHA512
c10124c74f33777a2992c2445321f79160b9b8d8aed26164a4ed88628d6c87e16bbbad8181f92122d4b17fbda33f4cbd697d83c37529a17ab77ccce94bd8a7ef

Download Submit
memory/232-1975-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/232-965-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/408-2013-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/416-2000-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/472-2721-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/516-3868-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/540-0-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/540-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/540-23-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/540-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/560-2568-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/564-1138-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/856-1282-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/872-1806-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1012-2598-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1012-2601-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1028-4233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1028-4236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-2425-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-2302-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1100-1807-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1164-3067-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1164-2954-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1224-1470-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1272-2588-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-2590-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1300-68-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1300-773-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1344-2460-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1344-2464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1500-2452-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1528-2044-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-1628-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1552-2330-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1580-4033-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1588-1895-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1588-774-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1680-3959-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1680-4107-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1748-967-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1776-3682-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1776-3753-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1920-2578-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-3341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-3420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2136-3349-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2136-3352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2188-1281-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2248-2143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2248-2284-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2260-4206-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-4368-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2340-4728-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2340-4725-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2344-1979-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2408-4358-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2544-2710-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2548-3940-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2548-3877-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2608-2311-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-3215-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-2934-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-2861-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3008-2640-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3008-2561-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-1990-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3080-4637-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3096-4054-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3500-1139-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3552-1891-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3568-2151-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3644-966-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3644-1988-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3752-2320-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3840-1627-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3920-1496-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3948-69-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3948-64-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3976-3441-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4040-1892-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4064-4114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4168-2612-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4168-2607-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4196-2475-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4196-2473-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4304-2174-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4344-3559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4356-4044-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-2001-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4384-2003-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-1893-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4400-4225-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4436-3275-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4436-3222-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4588-1980-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4740-57-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/4740-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4740-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4740-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4772-2162-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4892-2694-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4956-1991-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5004-1894-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5004-2064-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5008-3690-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5020-2444-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5020-2529-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-4500-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-4612-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5088-1140-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5108-1497-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download