pony | 4c55e79d6e6511326c21bb11e5046e198b5240a7adb4541d5df73e5befe211c0

Analysis

max time kernel
144s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
Size 2.2MB
Sample240614-t3wtjasclp
SHA256 4c55e79d6e6511326c21bb11e5046e198b5240a7adb4541d5df73e5befe211c0
MD5 aab3f45d603c8b01a21f879af7bb0fa7
SHA1 f7d4a2cb6996fe38c9a6bd639ae1821f279e4e02
SHA512 8d3dcfff711e55f296fa9efd927f505683526e6af8e5bfbe4bc86de5e7e744e00b959e630353a81684a4d21d9395ecc46570b925291f74abf6c2c989babac60e
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ3:0UzeyQMS4DqodCnoe+iitjWwwr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1476	explorer.exe
4760	explorer.exe
4840	spoolsv.exe
3328	spoolsv.exe
1564	spoolsv.exe
4128	spoolsv.exe
1124	spoolsv.exe
2684	spoolsv.exe
2428	spoolsv.exe
3572	spoolsv.exe
5032	spoolsv.exe
4596	spoolsv.exe
2320	spoolsv.exe
5072	spoolsv.exe
2112	spoolsv.exe
3724	spoolsv.exe
4668	spoolsv.exe
3872	spoolsv.exe
4396	spoolsv.exe
2476	spoolsv.exe
3904	spoolsv.exe
4652	spoolsv.exe
4480	spoolsv.exe
1408	spoolsv.exe
388	spoolsv.exe
5100	spoolsv.exe
1228	spoolsv.exe
2332	spoolsv.exe
3800	spoolsv.exe
2828	spoolsv.exe
2024	spoolsv.exe
832	spoolsv.exe
5372	spoolsv.exe
5668	spoolsv.exe
5972	spoolsv.exe
5164	spoolsv.exe
5756	spoolsv.exe
5856	spoolsv.exe
5908	explorer.exe
6044	spoolsv.exe
1640	spoolsv.exe
5208	spoolsv.exe
5632	spoolsv.exe
5828	spoolsv.exe
5084	spoolsv.exe
392	spoolsv.exe
5508	spoolsv.exe
5528	explorer.exe
5624	spoolsv.exe
5792	spoolsv.exe
2796	spoolsv.exe
6100	spoolsv.exe
5952	spoolsv.exe
5256	spoolsv.exe
5300	spoolsv.exe
440	spoolsv.exe
5824	explorer.exe
1364	spoolsv.exe
2060	spoolsv.exe
4208	spoolsv.exe
2904	spoolsv.exe
4648	spoolsv.exe
5220	spoolsv.exe
3336	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 56 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 3964	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	95
PID 1476 set thread context of 4760	1476	explorer.exe	102
PID 4840 set thread context of 5856	4840	spoolsv.exe	139
PID 3328 set thread context of 6044	3328	spoolsv.exe	141
PID 1564 set thread context of 1640	1564	spoolsv.exe	142
PID 4128 set thread context of 5208	4128	spoolsv.exe	143
PID 1124 set thread context of 5828	1124	spoolsv.exe	145
PID 2684 set thread context of 5084	2684	spoolsv.exe	146
PID 2428 set thread context of 392	2428	spoolsv.exe	147
PID 3572 set thread context of 5508	3572	spoolsv.exe	148
PID 5032 set thread context of 5624	5032	spoolsv.exe	150
PID 4596 set thread context of 5792	4596	spoolsv.exe	151
PID 2320 set thread context of 2796	2320	spoolsv.exe	152
PID 5072 set thread context of 5952	5072	spoolsv.exe	154
PID 2112 set thread context of 5256	2112	spoolsv.exe	155
PID 3724 set thread context of 5300	3724	spoolsv.exe	156
PID 4668 set thread context of 440	4668	spoolsv.exe	157
PID 3872 set thread context of 1364	3872	spoolsv.exe	159
PID 4396 set thread context of 2060	4396	spoolsv.exe	160
PID 2476 set thread context of 4208	2476	spoolsv.exe	161
PID 3904 set thread context of 2904	3904	spoolsv.exe	162
PID 4652 set thread context of 5220	4652	spoolsv.exe	164
PID 4480 set thread context of 3336	4480	spoolsv.exe	165
PID 1408 set thread context of 5444	1408	spoolsv.exe	167
PID 388 set thread context of 5840	388	spoolsv.exe	168
PID 5100 set thread context of 5648	5100	spoolsv.exe	169
PID 1228 set thread context of 4376	1228	spoolsv.exe	170
PID 2332 set thread context of 4812	2332	spoolsv.exe	171
PID 3800 set thread context of 1060	3800	spoolsv.exe	173
PID 2828 set thread context of 3944	2828	spoolsv.exe	175
PID 2024 set thread context of 5612	2024	spoolsv.exe	176
PID 832 set thread context of 5656	832	spoolsv.exe	177
PID 5372 set thread context of 1292	5372	spoolsv.exe	178
PID 5668 set thread context of 1796	5668	spoolsv.exe	179
PID 5972 set thread context of 2912	5972	spoolsv.exe	180
PID 5164 set thread context of 5464	5164	spoolsv.exe	183
PID 5756 set thread context of 5216	5756	spoolsv.exe	188
PID 5908 set thread context of 5776	5908	explorer.exe	193
PID 5632 set thread context of 1064	5632	spoolsv.exe	197
PID 5528 set thread context of 2644	5528	explorer.exe	201
PID 6100 set thread context of 4276	6100	spoolsv.exe	205
PID 5824 set thread context of 2868	5824	explorer.exe	208
PID 4648 set thread context of 2892	4648	spoolsv.exe	212
PID 5768 set thread context of 2688	5768	explorer.exe	214
PID 5764 set thread context of 6120	5764	explorer.exe	221
PID 1056 set thread context of 5812	1056	spoolsv.exe	222
PID 6076 set thread context of 6140	6076	spoolsv.exe	224
PID 4452 set thread context of 5572	4452	spoolsv.exe	225
PID 1176 set thread context of 5660	1176	explorer.exe	226
PID 1844 set thread context of 5404	1844	spoolsv.exe	227
PID 4888 set thread context of 5336	4888	spoolsv.exe	228
PID 4420 set thread context of 5524	4420	spoolsv.exe	229
PID 4800 set thread context of 4424	4800	explorer.exe	230
PID 5044 set thread context of 5560	5044	spoolsv.exe	232
PID 6024 set thread context of 4616	6024	spoolsv.exe	234
PID 3576 set thread context of 2044	3576	spoolsv.exe	236

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3964	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
3964	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4760	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3964	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
3964	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
4760	explorer.exe
5856	spoolsv.exe
5856	spoolsv.exe
6044	spoolsv.exe
6044	spoolsv.exe
1640	spoolsv.exe
1640	spoolsv.exe
5208	spoolsv.exe
5208	spoolsv.exe
5828	spoolsv.exe
5828	spoolsv.exe
5084	spoolsv.exe
5084	spoolsv.exe
392	spoolsv.exe
392	spoolsv.exe
5508	spoolsv.exe
5508	spoolsv.exe
5624	spoolsv.exe
5624	spoolsv.exe
5792	spoolsv.exe
5792	spoolsv.exe
2796	spoolsv.exe
2796	spoolsv.exe
5952	spoolsv.exe
5952	spoolsv.exe
5256	spoolsv.exe
5256	spoolsv.exe
5300	spoolsv.exe
5300	spoolsv.exe
440	spoolsv.exe
440	spoolsv.exe
1364	spoolsv.exe
1364	spoolsv.exe
2060	spoolsv.exe
2060	spoolsv.exe
4208	spoolsv.exe
4208	spoolsv.exe
2904	spoolsv.exe
2904	spoolsv.exe
5220	spoolsv.exe
5220	spoolsv.exe
3336	spoolsv.exe
3336	spoolsv.exe
5444	spoolsv.exe
5444	spoolsv.exe
5840	spoolsv.exe
5840	spoolsv.exe
5648	spoolsv.exe
5648	spoolsv.exe
4376	spoolsv.exe
4376	spoolsv.exe
4812	spoolsv.exe
4812	spoolsv.exe
1060	spoolsv.exe
1060	spoolsv.exe
3944	spoolsv.exe
3944	spoolsv.exe
5612	spoolsv.exe
5612	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 860	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	92
PID 3060 wrote to memory of 860	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	92
PID 3060 wrote to memory of 3964	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	95
PID 3060 wrote to memory of 3964	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	95
PID 3060 wrote to memory of 3964	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	95
PID 3060 wrote to memory of 3964	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	95
PID 3060 wrote to memory of 3964	3060	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	95
PID 3964 wrote to memory of 1476	3964	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	96
PID 3964 wrote to memory of 1476	3964	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	96
PID 3964 wrote to memory of 1476	3964	aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe	96
PID 1476 wrote to memory of 4760	1476	explorer.exe	102
PID 1476 wrote to memory of 4760	1476	explorer.exe	102
PID 1476 wrote to memory of 4760	1476	explorer.exe	102
PID 1476 wrote to memory of 4760	1476	explorer.exe	102
PID 1476 wrote to memory of 4760	1476	explorer.exe	102
PID 4760 wrote to memory of 4840	4760	explorer.exe	103
PID 4760 wrote to memory of 4840	4760	explorer.exe	103
PID 4760 wrote to memory of 4840	4760	explorer.exe	103
PID 4760 wrote to memory of 3328	4760	explorer.exe	104
PID 4760 wrote to memory of 3328	4760	explorer.exe	104
PID 4760 wrote to memory of 3328	4760	explorer.exe	104
PID 4760 wrote to memory of 1564	4760	explorer.exe	105
PID 4760 wrote to memory of 1564	4760	explorer.exe	105
PID 4760 wrote to memory of 1564	4760	explorer.exe	105
PID 4760 wrote to memory of 4128	4760	explorer.exe	106
PID 4760 wrote to memory of 4128	4760	explorer.exe	106
PID 4760 wrote to memory of 4128	4760	explorer.exe	106
PID 4760 wrote to memory of 1124	4760	explorer.exe	107
PID 4760 wrote to memory of 1124	4760	explorer.exe	107
PID 4760 wrote to memory of 1124	4760	explorer.exe	107
PID 4760 wrote to memory of 2684	4760	explorer.exe	108
PID 4760 wrote to memory of 2684	4760	explorer.exe	108
PID 4760 wrote to memory of 2684	4760	explorer.exe	108
PID 4760 wrote to memory of 2428	4760	explorer.exe	109
PID 4760 wrote to memory of 2428	4760	explorer.exe	109
PID 4760 wrote to memory of 2428	4760	explorer.exe	109
PID 4760 wrote to memory of 3572	4760	explorer.exe	110
PID 4760 wrote to memory of 3572	4760	explorer.exe	110
PID 4760 wrote to memory of 3572	4760	explorer.exe	110
PID 4760 wrote to memory of 5032	4760	explorer.exe	111
PID 4760 wrote to memory of 5032	4760	explorer.exe	111
PID 4760 wrote to memory of 5032	4760	explorer.exe	111
PID 4760 wrote to memory of 4596	4760	explorer.exe	112
PID 4760 wrote to memory of 4596	4760	explorer.exe	112
PID 4760 wrote to memory of 4596	4760	explorer.exe	112
PID 4760 wrote to memory of 2320	4760	explorer.exe	113
PID 4760 wrote to memory of 2320	4760	explorer.exe	113
PID 4760 wrote to memory of 2320	4760	explorer.exe	113
PID 4760 wrote to memory of 5072	4760	explorer.exe	114
PID 4760 wrote to memory of 5072	4760	explorer.exe	114
PID 4760 wrote to memory of 5072	4760	explorer.exe	114
PID 4760 wrote to memory of 2112	4760	explorer.exe	115
PID 4760 wrote to memory of 2112	4760	explorer.exe	115
PID 4760 wrote to memory of 2112	4760	explorer.exe	115
PID 4760 wrote to memory of 3724	4760	explorer.exe	116
PID 4760 wrote to memory of 3724	4760	explorer.exe	116
PID 4760 wrote to memory of 3724	4760	explorer.exe	116
PID 4760 wrote to memory of 4668	4760	explorer.exe	117
PID 4760 wrote to memory of 4668	4760	explorer.exe	117
PID 4760 wrote to memory of 4668	4760	explorer.exe	117
PID 4760 wrote to memory of 3872	4760	explorer.exe	118
PID 4760 wrote to memory of 3872	4760	explorer.exe	118
PID 4760 wrote to memory of 3872	4760	explorer.exe	118
PID 4760 wrote to memory of 4396	4760	explorer.exe	119

C:\Users\Admin\AppData\Local\Temp\aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:860
- C:\Users\Admin\AppData\Local\Temp\aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\aab3f45d603c8b01a21f879af7bb0fa7_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3964
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5908
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5528
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:440
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5824
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5768
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5764
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1796
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5464
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1176
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5216
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4800
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1192
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4276
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5812
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5560
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3576
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2824
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5124
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1360
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2812,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 112cdf9fc539c91eaeadaeea880785ffb4c617cea66adfc081d068ced3d9c5f1
MD5 73f41f190ff13d8f8d5a5f283fca1467
SHA1 2c64164465ad5fbf67773be9bbb94c8227cd4b49
SHA512 d44b16353a20a293a1643902d79fc4dc8d8835de9ac88bed6a6fee30864680d580f095e5ff3076e19b92af79ea4a67cc9e5b56fccefe0e0c3671ff0d9047006a
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWwwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 bf79d1ebf359124159f1cc45374a6bd608d706c9d738c5e1558f221c0a8579da
MD5 302fb933b9285bd0edd25a1c197b6dd9
SHA1 b551087049b698e9ac3f502a2e217e223de39bb7
SHA512 64e05584e27d27439cb8bc7120edcfd2056c4ba9d6ef023a0c9f6fbfed4b53ca14e58a10668f525ec8e5113ed66f73254371acd46890024630a5f8000196b5a6
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-2364-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/392-2498-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/440-2798-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1060-3197-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1064-4147-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1124-1425-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1228-2385-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1292-3235-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1364-2806-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1408-2363-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1476-80-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1476-86-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1564-1213-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1564-2388-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1640-2387-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1696-5772-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1796-3243-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2044-5692-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2060-2815-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2112-1835-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2320-1636-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2428-1427-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2476-2276-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2644-4350-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2684-1426-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2688-4938-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2688-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2796-2621-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2796-2616-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2824-5751-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2868-4682-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2868-4685-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2892-4999-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2892-4872-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2912-3283-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3060-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3060-38-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3060-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3060-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3328-1212-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3328-2375-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3572-1633-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3724-1836-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3872-2091-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3904-2277-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3944-3204-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3964-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3964-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3964-39-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4128-1224-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4208-2829-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4396-2092-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4424-5486-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-2279-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4596-1635-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4616-5688-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4616-5574-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4652-2278-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4668-2085-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4760-950-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4760-85-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4812-3064-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4840-2366-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4840-951-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5032-1634-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5068-5760-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5072-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5084-2490-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5100-2373-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5124-5915-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5208-2395-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5208-2399-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5216-3801-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5216-3679-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5220-2924-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5256-2724-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5256-2728-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5300-2735-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5336-5396-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5404-5389-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5444-3025-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5444-3022-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5464-3462-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5464-3550-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5508-2589-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5524-5410-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5560-5567-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5572-5368-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5612-3213-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5612-3216-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5624-2598-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5656-3225-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5656-3222-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5660-5378-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5776-3976-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5776-3974-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5792-2608-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5812-5346-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5820-5783-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5828-2477-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5840-3035-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5856-2569-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5856-2365-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5952-2704-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6044-2374-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/6044-2376-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/6120-5349-0x0000000000400000-0x000000000043E000-memory.dmp

Download