pony | c81a3f3d68bfac845f60e5c0c42c0a5b7bf5d0e66f1aaf48c5e09a52ff8bb6a2

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
Size

2.2MB
MD5

aaf2b1247931b6ae9c058619713ade11
SHA1

0ca64de050815c4ec79e895de4df17b6e1b67ac4
SHA256

c81a3f3d68bfac845f60e5c0c42c0a5b7bf5d0e66f1aaf48c5e09a52ff8bb6a2
SHA512

14dadb091ca7b23a7c40d6e97dde7822bdf3e81aee4396211e12d862aae61cb800bd0c6ccc0495de995dbf614b2fbd2dee5b391526de83040c6618724b02401f
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWwwJ

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
548	explorer.exe
1788	explorer.exe
4500	spoolsv.exe
724	spoolsv.exe
1572	spoolsv.exe
4416	spoolsv.exe
3704	spoolsv.exe
4336	spoolsv.exe
2336	spoolsv.exe
1680	spoolsv.exe
1400	spoolsv.exe
3936	spoolsv.exe
2376	spoolsv.exe
1540	spoolsv.exe
1068	spoolsv.exe
4684	spoolsv.exe
4808	spoolsv.exe
4828	spoolsv.exe
2132	spoolsv.exe
3516	spoolsv.exe
744	spoolsv.exe
3440	spoolsv.exe
1508	spoolsv.exe
4856	spoolsv.exe
548	spoolsv.exe
2344	spoolsv.exe
1164	spoolsv.exe
2196	spoolsv.exe
2420	spoolsv.exe
5244	spoolsv.exe
5544	spoolsv.exe
5848	spoolsv.exe
376	spoolsv.exe
5344	spoolsv.exe
5656	spoolsv.exe
5944	spoolsv.exe
5216	spoolsv.exe
5532	spoolsv.exe
5608	explorer.exe
5720	spoolsv.exe
5828	spoolsv.exe
5192	spoolsv.exe
5284	spoolsv.exe
884	spoolsv.exe
1928	spoolsv.exe
2512	spoolsv.exe
2768	spoolsv.exe
5956	spoolsv.exe
5156	spoolsv.exe
5212	explorer.exe
3576	spoolsv.exe
5568	spoolsv.exe
5708	spoolsv.exe
3164	spoolsv.exe
4072	spoolsv.exe
1000	spoolsv.exe
5984	spoolsv.exe
6116	spoolsv.exe
6020	spoolsv.exe
5428	spoolsv.exe
1296	spoolsv.exe
5756	spoolsv.exe
5740	explorer.exe
2368	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 48 IoCs

description	pid	Process	procid_target
PID 4532 set thread context of 228	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	100
PID 548 set thread context of 1788	548	explorer.exe	107
PID 4500 set thread context of 5532	4500	spoolsv.exe	144
PID 724 set thread context of 5720	724	spoolsv.exe	146
PID 1572 set thread context of 5828	1572	spoolsv.exe	147
PID 4416 set thread context of 5284	4416	spoolsv.exe	149
PID 3704 set thread context of 884	3704	spoolsv.exe	150
PID 4336 set thread context of 1928	4336	spoolsv.exe	151
PID 2336 set thread context of 2512	2336	spoolsv.exe	152
PID 1680 set thread context of 2768	1680	spoolsv.exe	153
PID 1400 set thread context of 5956	1400	spoolsv.exe	154
PID 3936 set thread context of 5156	3936	spoolsv.exe	155
PID 2376 set thread context of 3576	2376	spoolsv.exe	157
PID 1540 set thread context of 5568	1540	spoolsv.exe	158
PID 1068 set thread context of 5708	1068	spoolsv.exe	159
PID 4684 set thread context of 3164	4684	spoolsv.exe	160
PID 4808 set thread context of 1000	4808	spoolsv.exe	162
PID 4828 set thread context of 5984	4828	spoolsv.exe	163
PID 2132 set thread context of 6116	2132	spoolsv.exe	164
PID 3516 set thread context of 6020	3516	spoolsv.exe	165
PID 744 set thread context of 5428	744	spoolsv.exe	166
PID 3440 set thread context of 1296	3440	spoolsv.exe	167
PID 1508 set thread context of 5756	1508	spoolsv.exe	168
PID 4856 set thread context of 2368	4856	spoolsv.exe	170
PID 548 set thread context of 5768	548	spoolsv.exe	171
PID 2344 set thread context of 5900	2344	spoolsv.exe	172
PID 1164 set thread context of 3700	1164	spoolsv.exe	174
PID 2196 set thread context of 388	2196	spoolsv.exe	175
PID 2420 set thread context of 1904	2420	spoolsv.exe	176
PID 5244 set thread context of 5168	5244	spoolsv.exe	177
PID 5544 set thread context of 5460	5544	spoolsv.exe	178
PID 5848 set thread context of 5464	5848	spoolsv.exe	179
PID 376 set thread context of 5916	376	spoolsv.exe	180
PID 5344 set thread context of 5440	5344	spoolsv.exe	182
PID 5656 set thread context of 1116	5656	spoolsv.exe	183
PID 5944 set thread context of 3136	5944	spoolsv.exe	184
PID 5216 set thread context of 4352	5216	spoolsv.exe	188
PID 5608 set thread context of 6104	5608	explorer.exe	196
PID 5192 set thread context of 5860	5192	spoolsv.exe	202
PID 5212 set thread context of 6008	5212	explorer.exe	209
PID 4072 set thread context of 6080	4072	spoolsv.exe	215
PID 5740 set thread context of 4200	5740	explorer.exe	223
PID 1016 set thread context of 5992	1016	spoolsv.exe	226
PID 6088 set thread context of 5536	6088	spoolsv.exe	229
PID 5864 set thread context of 2916	5864	spoolsv.exe	231
PID 1448 set thread context of 5840	1448	spoolsv.exe	232
PID 4732 set thread context of 3288	4732	explorer.exe	233
PID 4936 set thread context of 5372	4936	spoolsv.exe	234

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
228	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
228	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1788	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
228	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
228	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
1788	explorer.exe
5532	spoolsv.exe
5532	spoolsv.exe
5720	spoolsv.exe
5720	spoolsv.exe
5828	spoolsv.exe
5828	spoolsv.exe
5284	spoolsv.exe
5284	spoolsv.exe
884	spoolsv.exe
884	spoolsv.exe
1928	spoolsv.exe
1928	spoolsv.exe
2512	spoolsv.exe
2512	spoolsv.exe
2768	spoolsv.exe
2768	spoolsv.exe
5956	spoolsv.exe
5956	spoolsv.exe
5156	spoolsv.exe
5156	spoolsv.exe
3576	spoolsv.exe
3576	spoolsv.exe
5568	spoolsv.exe
5568	spoolsv.exe
5708	spoolsv.exe
5708	spoolsv.exe
3164	spoolsv.exe
3164	spoolsv.exe
1000	spoolsv.exe
1000	spoolsv.exe
5984	spoolsv.exe
5984	spoolsv.exe
6116	spoolsv.exe
6116	spoolsv.exe
6020	spoolsv.exe
6020	spoolsv.exe
5428	spoolsv.exe
5428	spoolsv.exe
1296	spoolsv.exe
1296	spoolsv.exe
5756	spoolsv.exe
5756	spoolsv.exe
2368	spoolsv.exe
2368	spoolsv.exe
5768	spoolsv.exe
5768	spoolsv.exe
5900	spoolsv.exe
5900	spoolsv.exe
3700	spoolsv.exe
3700	spoolsv.exe
388	spoolsv.exe
388	spoolsv.exe
1904	spoolsv.exe
1904	spoolsv.exe
5168	spoolsv.exe
5168	spoolsv.exe
5460	spoolsv.exe
5460	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4620	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	93
PID 4532 wrote to memory of 4620	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	93
PID 4532 wrote to memory of 228	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	100
PID 4532 wrote to memory of 228	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	100
PID 4532 wrote to memory of 228	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	100
PID 4532 wrote to memory of 228	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	100
PID 4532 wrote to memory of 228	4532	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	100
PID 228 wrote to memory of 548	228	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	101
PID 228 wrote to memory of 548	228	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	101
PID 228 wrote to memory of 548	228	aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe	101
PID 548 wrote to memory of 1788	548	explorer.exe	107
PID 548 wrote to memory of 1788	548	explorer.exe	107
PID 548 wrote to memory of 1788	548	explorer.exe	107
PID 548 wrote to memory of 1788	548	explorer.exe	107
PID 548 wrote to memory of 1788	548	explorer.exe	107
PID 1788 wrote to memory of 4500	1788	explorer.exe	108
PID 1788 wrote to memory of 4500	1788	explorer.exe	108
PID 1788 wrote to memory of 4500	1788	explorer.exe	108
PID 1788 wrote to memory of 724	1788	explorer.exe	109
PID 1788 wrote to memory of 724	1788	explorer.exe	109
PID 1788 wrote to memory of 724	1788	explorer.exe	109
PID 1788 wrote to memory of 1572	1788	explorer.exe	110
PID 1788 wrote to memory of 1572	1788	explorer.exe	110
PID 1788 wrote to memory of 1572	1788	explorer.exe	110
PID 1788 wrote to memory of 4416	1788	explorer.exe	111
PID 1788 wrote to memory of 4416	1788	explorer.exe	111
PID 1788 wrote to memory of 4416	1788	explorer.exe	111
PID 1788 wrote to memory of 3704	1788	explorer.exe	112
PID 1788 wrote to memory of 3704	1788	explorer.exe	112
PID 1788 wrote to memory of 3704	1788	explorer.exe	112
PID 1788 wrote to memory of 4336	1788	explorer.exe	113
PID 1788 wrote to memory of 4336	1788	explorer.exe	113
PID 1788 wrote to memory of 4336	1788	explorer.exe	113
PID 1788 wrote to memory of 2336	1788	explorer.exe	114
PID 1788 wrote to memory of 2336	1788	explorer.exe	114
PID 1788 wrote to memory of 2336	1788	explorer.exe	114
PID 1788 wrote to memory of 1680	1788	explorer.exe	115
PID 1788 wrote to memory of 1680	1788	explorer.exe	115
PID 1788 wrote to memory of 1680	1788	explorer.exe	115
PID 1788 wrote to memory of 1400	1788	explorer.exe	116
PID 1788 wrote to memory of 1400	1788	explorer.exe	116
PID 1788 wrote to memory of 1400	1788	explorer.exe	116
PID 1788 wrote to memory of 3936	1788	explorer.exe	117
PID 1788 wrote to memory of 3936	1788	explorer.exe	117
PID 1788 wrote to memory of 3936	1788	explorer.exe	117
PID 1788 wrote to memory of 2376	1788	explorer.exe	118
PID 1788 wrote to memory of 2376	1788	explorer.exe	118
PID 1788 wrote to memory of 2376	1788	explorer.exe	118
PID 1788 wrote to memory of 1540	1788	explorer.exe	119
PID 1788 wrote to memory of 1540	1788	explorer.exe	119
PID 1788 wrote to memory of 1540	1788	explorer.exe	119
PID 1788 wrote to memory of 1068	1788	explorer.exe	120
PID 1788 wrote to memory of 1068	1788	explorer.exe	120
PID 1788 wrote to memory of 1068	1788	explorer.exe	120
PID 1788 wrote to memory of 4684	1788	explorer.exe	121
PID 1788 wrote to memory of 4684	1788	explorer.exe	121
PID 1788 wrote to memory of 4684	1788	explorer.exe	121
PID 1788 wrote to memory of 4808	1788	explorer.exe	122
PID 1788 wrote to memory of 4808	1788	explorer.exe	122
PID 1788 wrote to memory of 4808	1788	explorer.exe	122
PID 1788 wrote to memory of 4828	1788	explorer.exe	123
PID 1788 wrote to memory of 4828	1788	explorer.exe	123
PID 1788 wrote to memory of 4828	1788	explorer.exe	123
PID 1788 wrote to memory of 2132	1788	explorer.exe	124

C:\Users\Admin\AppData\Local\Temp\aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\aaf2b1247931b6ae9c058619713ade11_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:228
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:548
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5532
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5284
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5212
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2132
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5756
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5740
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4856
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2420
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5916
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:980
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4732
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3288
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5860
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6080
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5992
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:6028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:6088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5372
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5776
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5332
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5552
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:6004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3716
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4136,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
da56469ca53980797e5506f2c12afddf

SHA1
677520111b38f017ce6ed96fa241c52574c34779

SHA256
35653a119c67130ebb34b31369c1805b213b4ea46d9d92ff93a7a7ce2bcdb06f

SHA512
999233c23c361b4fee5189cbdea009c4f581ea6ae793d69403871e39d1793e62b6b383c635e515f79f984e9188de7880f5f1dae5976f972fa9d495f111647332

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
d5b46d2cba16150ebd97cf0e1c354320

SHA1
5bd627b21cc69ee685d5f4ec8444e10feccbd7d8

SHA256
82b4091790731b10c246f6b2a2b486504376381ab2ebf794438ac28ef55f2a42

SHA512
4d49420cdd344b463f5a40d1e252ac2c54f3dfb5080bc92ea292f5aac63e5a7451a789a812a4b899a075108abacb669f13bc1571a2e2d2eddfaa22f9a465abbf

Download Submit
memory/228-62-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/228-34-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/228-36-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/548-77-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/548-73-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/548-2330-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/724-1149-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/724-2343-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/744-2248-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/884-2452-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/884-2449-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1068-1801-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1116-3066-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1164-2351-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1212-5796-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1296-2784-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1400-1585-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1508-2328-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1540-1800-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1572-1150-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1572-2355-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1680-1584-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1788-967-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1788-78-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1904-2929-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1928-2463-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2132-2018-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2256-5732-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2256-5737-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2336-1364-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2344-2336-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2368-2810-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2376-1799-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2512-2472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2768-2483-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2916-5530-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3136-3076-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3164-2622-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3288-5632-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3440-2249-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3516-2242-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3576-2557-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3700-2914-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3704-1362-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3936-1586-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4200-5315-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4228-5758-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4228-5744-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4336-1363-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4352-3298-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4416-1151-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4500-968-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4500-2332-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4532-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4532-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4532-33-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/4532-0-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/4684-1802-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4808-2016-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4824-5776-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4828-2017-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4856-2329-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5148-5807-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5148-5811-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5156-2775-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5156-2547-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5160-5718-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5284-2438-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5428-2715-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5440-3058-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5460-2948-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5464-2958-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5464-2955-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5532-2331-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5532-2527-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5536-5472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5536-5476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5568-2566-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5720-2342-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5720-2340-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/5748-5785-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5756-2802-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5828-2353-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5860-4192-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5860-4075-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5900-2828-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5916-3049-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5916-3159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5956-2493-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5984-2686-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5992-5455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6008-4450-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6080-4939-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6104-3723-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6112-5465-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6116-2695-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download