pony | 85c77760305e4204d4ae15048f29754c13e47b327bd6ea9a77d31c82f07d59eb

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
Size 2.2MB
Sample240614-vh45vaygnc
SHA256 85c77760305e4204d4ae15048f29754c13e47b327bd6ea9a77d31c82f07d59eb
MD5 aacb697edf031cf878e7bf2f2ec116a3
SHA1 796524184fdace2498ef21435cb76b4aee57e40f
SHA512 a821942d1668a754f361823dc7bb3cee654b03b0bfd9010c43d6adf1dcd31110f565a7a3d659b0adc99999604ae0a34bd5423fc2082447e8a38456dbc05448d9
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZI:0UzeyQMS4DqodCnoe+iitjWww0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
936	explorer.exe
2800	explorer.exe
1204	spoolsv.exe
2212	spoolsv.exe
4620	spoolsv.exe
3708	spoolsv.exe
944	spoolsv.exe
2164	spoolsv.exe
3720	spoolsv.exe
5056	spoolsv.exe
4500	spoolsv.exe
3624	spoolsv.exe
4020	spoolsv.exe
4568	spoolsv.exe
3512	spoolsv.exe
2888	spoolsv.exe
2724	spoolsv.exe
3452	spoolsv.exe
4056	spoolsv.exe
4668	spoolsv.exe
3704	spoolsv.exe
3360	spoolsv.exe
3356	spoolsv.exe
1672	spoolsv.exe
4304	spoolsv.exe
692	spoolsv.exe
4952	spoolsv.exe
4876	spoolsv.exe
4584	spoolsv.exe
2004	spoolsv.exe
2940	spoolsv.exe
1888	spoolsv.exe
116	spoolsv.exe
4608	spoolsv.exe
1924	spoolsv.exe
3916	spoolsv.exe
4228	spoolsv.exe
4512	spoolsv.exe
4436	explorer.exe
4932	spoolsv.exe
4292	spoolsv.exe
1968	spoolsv.exe
2740	spoolsv.exe
4492	spoolsv.exe
3644	spoolsv.exe
756	spoolsv.exe
3588	spoolsv.exe
3984	explorer.exe
2916	spoolsv.exe
4536	spoolsv.exe
5096	spoolsv.exe
2780	spoolsv.exe
4312	spoolsv.exe
3164	spoolsv.exe
1152	spoolsv.exe
2584	spoolsv.exe
3928	spoolsv.exe
4348	explorer.exe
4640	spoolsv.exe
3212	spoolsv.exe
4856	spoolsv.exe
3520	spoolsv.exe
3268	spoolsv.exe
4944	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 59 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 4776	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	87
PID 936 set thread context of 2800	936	explorer.exe	92
PID 1204 set thread context of 4512	1204	spoolsv.exe	128
PID 2212 set thread context of 4932	2212	spoolsv.exe	130
PID 4620 set thread context of 1968	4620	spoolsv.exe	132
PID 3708 set thread context of 2740	3708	spoolsv.exe	133
PID 944 set thread context of 4492	944	spoolsv.exe	134
PID 2164 set thread context of 3644	2164	spoolsv.exe	135
PID 3720 set thread context of 756	3720	spoolsv.exe	136
PID 5056 set thread context of 3588	5056	spoolsv.exe	137
PID 4500 set thread context of 2916	4500	spoolsv.exe	139
PID 3624 set thread context of 5096	3624	spoolsv.exe	141
PID 4020 set thread context of 2780	4020	spoolsv.exe	142
PID 4568 set thread context of 4312	4568	spoolsv.exe	143
PID 3512 set thread context of 3164	3512	spoolsv.exe	144
PID 2888 set thread context of 1152	2888	spoolsv.exe	145
PID 2724 set thread context of 2584	2724	spoolsv.exe	146
PID 3452 set thread context of 3928	3452	spoolsv.exe	147
PID 4056 set thread context of 3212	4056	spoolsv.exe	150
PID 4668 set thread context of 4856	4668	spoolsv.exe	151
PID 3704 set thread context of 3520	3704	spoolsv.exe	152
PID 3360 set thread context of 3268	3360	spoolsv.exe	153
PID 3356 set thread context of 4944	3356	spoolsv.exe	154
PID 1672 set thread context of 2040	1672	spoolsv.exe	155
PID 4304 set thread context of 2984	4304	spoolsv.exe	158
PID 692 set thread context of 2228	692	spoolsv.exe	159
PID 4952 set thread context of 208	4952	spoolsv.exe	160
PID 4876 set thread context of 2532	4876	spoolsv.exe	161
PID 4584 set thread context of 684	4584	spoolsv.exe	162
PID 2004 set thread context of 4368	2004	spoolsv.exe	164
PID 2940 set thread context of 4372	2940	spoolsv.exe	166
PID 1888 set thread context of 1920	1888	spoolsv.exe	167
PID 116 set thread context of 3692	116	spoolsv.exe	168
PID 4608 set thread context of 4224	4608	spoolsv.exe	169
PID 1924 set thread context of 628	1924	spoolsv.exe	171
PID 3916 set thread context of 3540	3916	spoolsv.exe	173
PID 4228 set thread context of 3944	4228	spoolsv.exe	175
PID 4436 set thread context of 1948	4436	explorer.exe	179
PID 4292 set thread context of 1436	4292	spoolsv.exe	181
PID 3984 set thread context of 2696	3984	explorer.exe	189
PID 4536 set thread context of 3524	4536	spoolsv.exe	191
PID 4348 set thread context of 2680	4348	explorer.exe	197
PID 4640 set thread context of 2156	4640	spoolsv.exe	198
PID 4644 set thread context of 3792	4644	explorer.exe	203
PID 1028 set thread context of 1568	1028	spoolsv.exe	204
PID 4448 set thread context of 3740	4448	explorer.exe	210
PID 3988 set thread context of 2168	3988	spoolsv.exe	211
PID 2608 set thread context of 3912	2608	explorer.exe	214
PID 2192 set thread context of 2972	2192	spoolsv.exe	215
PID 4692 set thread context of 5024	4692	spoolsv.exe	217
PID 544 set thread context of 4036	544	explorer.exe	219
PID 4396 set thread context of 532	4396	spoolsv.exe	221
PID 4432 set thread context of 4152	4432	spoolsv.exe	224
PID 4452 set thread context of 2560	4452	spoolsv.exe	227
PID 3564 set thread context of 4300	3564	spoolsv.exe	228
PID 1528 set thread context of 1944	1528	explorer.exe	229
PID 1956 set thread context of 2416	1956	spoolsv.exe	230
PID 4016 set thread context of 4976	4016	spoolsv.exe	231
PID 2396 set thread context of 1296	2396	spoolsv.exe	232

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
4776	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4776	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
4776	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
2800	explorer.exe
4512	spoolsv.exe
4512	spoolsv.exe
4932	spoolsv.exe
4932	spoolsv.exe
1968	spoolsv.exe
1968	spoolsv.exe
2740	spoolsv.exe
2740	spoolsv.exe
4492	spoolsv.exe
4492	spoolsv.exe
3644	spoolsv.exe
3644	spoolsv.exe
756	spoolsv.exe
756	spoolsv.exe
3588	spoolsv.exe
3588	spoolsv.exe
2916	spoolsv.exe
2916	spoolsv.exe
5096	spoolsv.exe
5096	spoolsv.exe
2780	spoolsv.exe
2780	spoolsv.exe
4312	spoolsv.exe
4312	spoolsv.exe
3164	spoolsv.exe
3164	spoolsv.exe
1152	spoolsv.exe
1152	spoolsv.exe
2584	spoolsv.exe
2584	spoolsv.exe
3928	spoolsv.exe
3928	spoolsv.exe
3212	spoolsv.exe
3212	spoolsv.exe
4856	spoolsv.exe
4856	spoolsv.exe
3520	spoolsv.exe
3520	spoolsv.exe
3268	spoolsv.exe
3268	spoolsv.exe
4944	spoolsv.exe
4944	spoolsv.exe
2040	spoolsv.exe
2040	spoolsv.exe
2984	spoolsv.exe
2984	spoolsv.exe
2228	spoolsv.exe
2228	spoolsv.exe
208	spoolsv.exe
208	spoolsv.exe
2532	spoolsv.exe
2532	spoolsv.exe
684	spoolsv.exe
684	spoolsv.exe
4368	spoolsv.exe
4368	spoolsv.exe
4372	spoolsv.exe
4372	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4884	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	82
PID 1832 wrote to memory of 4884	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	82
PID 1832 wrote to memory of 4776	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	87
PID 1832 wrote to memory of 4776	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	87
PID 1832 wrote to memory of 4776	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	87
PID 1832 wrote to memory of 4776	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	87
PID 1832 wrote to memory of 4776	1832	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	87
PID 4776 wrote to memory of 936	4776	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	88
PID 4776 wrote to memory of 936	4776	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	88
PID 4776 wrote to memory of 936	4776	aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe	88
PID 936 wrote to memory of 2800	936	explorer.exe	92
PID 936 wrote to memory of 2800	936	explorer.exe	92
PID 936 wrote to memory of 2800	936	explorer.exe	92
PID 936 wrote to memory of 2800	936	explorer.exe	92
PID 936 wrote to memory of 2800	936	explorer.exe	92
PID 2800 wrote to memory of 1204	2800	explorer.exe	93
PID 2800 wrote to memory of 1204	2800	explorer.exe	93
PID 2800 wrote to memory of 1204	2800	explorer.exe	93
PID 2800 wrote to memory of 2212	2800	explorer.exe	94
PID 2800 wrote to memory of 2212	2800	explorer.exe	94
PID 2800 wrote to memory of 2212	2800	explorer.exe	94
PID 2800 wrote to memory of 4620	2800	explorer.exe	95
PID 2800 wrote to memory of 4620	2800	explorer.exe	95
PID 2800 wrote to memory of 4620	2800	explorer.exe	95
PID 2800 wrote to memory of 3708	2800	explorer.exe	96
PID 2800 wrote to memory of 3708	2800	explorer.exe	96
PID 2800 wrote to memory of 3708	2800	explorer.exe	96
PID 2800 wrote to memory of 944	2800	explorer.exe	97
PID 2800 wrote to memory of 944	2800	explorer.exe	97
PID 2800 wrote to memory of 944	2800	explorer.exe	97
PID 2800 wrote to memory of 2164	2800	explorer.exe	98
PID 2800 wrote to memory of 2164	2800	explorer.exe	98
PID 2800 wrote to memory of 2164	2800	explorer.exe	98
PID 2800 wrote to memory of 3720	2800	explorer.exe	99
PID 2800 wrote to memory of 3720	2800	explorer.exe	99
PID 2800 wrote to memory of 3720	2800	explorer.exe	99
PID 2800 wrote to memory of 5056	2800	explorer.exe	100
PID 2800 wrote to memory of 5056	2800	explorer.exe	100
PID 2800 wrote to memory of 5056	2800	explorer.exe	100
PID 2800 wrote to memory of 4500	2800	explorer.exe	101
PID 2800 wrote to memory of 4500	2800	explorer.exe	101
PID 2800 wrote to memory of 4500	2800	explorer.exe	101
PID 2800 wrote to memory of 3624	2800	explorer.exe	102
PID 2800 wrote to memory of 3624	2800	explorer.exe	102
PID 2800 wrote to memory of 3624	2800	explorer.exe	102
PID 2800 wrote to memory of 4020	2800	explorer.exe	103
PID 2800 wrote to memory of 4020	2800	explorer.exe	103
PID 2800 wrote to memory of 4020	2800	explorer.exe	103
PID 2800 wrote to memory of 4568	2800	explorer.exe	104
PID 2800 wrote to memory of 4568	2800	explorer.exe	104
PID 2800 wrote to memory of 4568	2800	explorer.exe	104
PID 2800 wrote to memory of 3512	2800	explorer.exe	105
PID 2800 wrote to memory of 3512	2800	explorer.exe	105
PID 2800 wrote to memory of 3512	2800	explorer.exe	105
PID 2800 wrote to memory of 2888	2800	explorer.exe	106
PID 2800 wrote to memory of 2888	2800	explorer.exe	106
PID 2800 wrote to memory of 2888	2800	explorer.exe	106
PID 2800 wrote to memory of 2724	2800	explorer.exe	107
PID 2800 wrote to memory of 2724	2800	explorer.exe	107
PID 2800 wrote to memory of 2724	2800	explorer.exe	107
PID 2800 wrote to memory of 3452	2800	explorer.exe	108
PID 2800 wrote to memory of 3452	2800	explorer.exe	108
PID 2800 wrote to memory of 3452	2800	explorer.exe	108
PID 2800 wrote to memory of 4056	2800	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4884
- C:\Users\Admin\AppData\Local\Temp\aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\aacb697edf031cf878e7bf2f2ec116a3_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4776
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:936
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1204
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4620
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3928
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4348
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4056
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4644
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4952
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4368
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4448
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4372
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:628
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:2608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3944
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1436
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1528
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3524
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2516
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1568
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2168
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3204
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:532
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2560
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3440
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4384
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 db16bc55191826ae93300f91553d3b0d59edbf6f58c707f2a655ad6b79f38dee
MD5 3e99c6b2c8e04a64cdfa808e5c9d1093
SHA1 4a6fee8edf0b188518e60db76327ac46b33722fa
SHA512 db2acbbb3630e1de2e633f400194f64689b8684af8d932a6ff39a3698760fd47eb863f8f35d518f5a7217e153ec74e52999358eadcd27e48cd1cd1f88d286904
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 b892d22f2fb2cc08e77dad6b0461c8268d81328552e20b8e13f7c0d39acc8a6c
MD5 efd1472420e63dc6b8e3da2d7ae6cf14
SHA1 38fe8f254aa7158e5dd2927d58db06dd6d622843
SHA512 06f8fafb80decdab4f09da19986c1c2f065e54d0d654cbcb0fa53a591c96994579048ec71965d0cae87e9212a0112de0bbedae98997652c57f850c39172c6808
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZI:0UzeyQMS4DqodCnoe+iitjWwwU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-5785-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/532-5667-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/628-3538-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/628-3441-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/684-3134-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/692-2313-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/756-2455-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/936-98-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/936-103-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/944-1410-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1152-2669-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1152-2665-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1204-1023-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1204-2306-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1296-5940-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1568-5095-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1672-2303-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1832-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1832-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1832-43-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1832-0-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1944-5911-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-3723-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1968-2413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2040-3174-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2156-4705-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2164-1411-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2168-5304-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2168-5437-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2212-1219-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2212-2317-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2228-3099-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2228-3094-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2416-5919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2532-3117-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2584-2677-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2680-4700-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2696-4260-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2724-2015-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2740-2423-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2776-5950-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2780-2634-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2800-102-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2800-1022-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2888-1796-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2916-2528-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2972-5390-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3164-2657-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-2863-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3268-2892-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3356-2220-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3360-2219-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3452-2016-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3512-1795-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3520-2886-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3524-4449-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3540-3460-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3588-2519-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3588-2708-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-1595-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3644-2446-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3692-3288-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3704-2218-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3708-1221-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3720-1412-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3740-5297-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3792-4955-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3912-5382-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3928-2776-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3944-3667-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3944-3554-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4020-1596-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4036-5540-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4056-2017-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4152-5816-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4152-5995-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4224-3295-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4300-5897-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4304-2304-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4312-2645-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4368-3261-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4384-6024-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4492-2435-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4500-1594-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4512-2305-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4512-2500-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4568-1794-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4620-2414-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4620-1220-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4668-2018-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4776-44-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4776-46-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4776-87-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-2315-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4932-2314-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-2318-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-2905-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4944-2901-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-2411-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4976-5929-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5024-5529-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5056-1413-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5096-2623-0x0000000000400000-0x000000000043E000-memory.dmp

Download