pony | 1388b51851be9fc75e81d7929276808028eacaec1d556734b96999089342eedd

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
Size 2.2MB
Sample240614-wh41hsvbmm
SHA256 1388b51851be9fc75e81d7929276808028eacaec1d556734b96999089342eedd
MD5 ab0392e3501ee064242562eb651b5cee
SHA1 e1687516765cf7fd3a312902278b16b674de4a17
SHA512 837baf4bcfc77a3658956e531366ff4bdf4c28f12f526479659ecbec93155728b418b4f3e2dbda8af2c7cb1f4d7dd95840f0a6c5b5334305574cc992a5175953
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZx:0UzeyQMS4DqodCnoe+iitjWwwV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1804	explorer.exe
2404	explorer.exe
2320	spoolsv.exe
1432	spoolsv.exe
2928	spoolsv.exe
4808	spoolsv.exe
4540	spoolsv.exe
1668	spoolsv.exe
1760	spoolsv.exe
2140	spoolsv.exe
4656	spoolsv.exe
3944	spoolsv.exe
4448	spoolsv.exe
4176	spoolsv.exe
4460	spoolsv.exe
2592	spoolsv.exe
4408	spoolsv.exe
1604	spoolsv.exe
4216	spoolsv.exe
4708	spoolsv.exe
2376	spoolsv.exe
4804	spoolsv.exe
2784	spoolsv.exe
3636	spoolsv.exe
2668	spoolsv.exe
4080	spoolsv.exe
5064	spoolsv.exe
3008	spoolsv.exe
4988	spoolsv.exe
3040	spoolsv.exe
5040	spoolsv.exe
4972	spoolsv.exe
2348	spoolsv.exe
3984	explorer.exe
1208	spoolsv.exe
1100	spoolsv.exe
1428	spoolsv.exe
2660	spoolsv.exe
2640	spoolsv.exe
1136	spoolsv.exe
3848	explorer.exe
4676	spoolsv.exe
1684	spoolsv.exe
2500	spoolsv.exe
4368	spoolsv.exe
924	spoolsv.exe
4828	spoolsv.exe
1368	explorer.exe
3800	spoolsv.exe
1584	spoolsv.exe
3016	spoolsv.exe
4604	spoolsv.exe
3508	spoolsv.exe
3548	explorer.exe
4528	spoolsv.exe
1876	spoolsv.exe
2260	spoolsv.exe
4820	spoolsv.exe
3540	explorer.exe
4832	spoolsv.exe
4648	spoolsv.exe
3336	spoolsv.exe
3916	spoolsv.exe
2484	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 52 IoCs

description	pid	Process	procid_target
PID 4444 set thread context of 3500	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	83
PID 1804 set thread context of 2404	1804	explorer.exe	92
PID 2320 set thread context of 2348	2320	spoolsv.exe	123
PID 1432 set thread context of 1208	1432	spoolsv.exe	125
PID 2928 set thread context of 1100	2928	spoolsv.exe	126
PID 4808 set thread context of 1428	4808	spoolsv.exe	127
PID 4540 set thread context of 2640	4540	spoolsv.exe	129
PID 1668 set thread context of 1136	1668	spoolsv.exe	130
PID 1760 set thread context of 4676	1760	spoolsv.exe	132
PID 2140 set thread context of 1684	2140	spoolsv.exe	133
PID 4656 set thread context of 4368	4656	spoolsv.exe	135
PID 3944 set thread context of 924	3944	spoolsv.exe	136
PID 4448 set thread context of 4828	4448	spoolsv.exe	137
PID 4176 set thread context of 3800	4176	spoolsv.exe	139
PID 4460 set thread context of 1584	4460	spoolsv.exe	140
PID 2592 set thread context of 4604	2592	spoolsv.exe	142
PID 4408 set thread context of 3508	4408	spoolsv.exe	143
PID 1604 set thread context of 4528	1604	spoolsv.exe	145
PID 4216 set thread context of 1876	4216	spoolsv.exe	146
PID 4708 set thread context of 4820	4708	spoolsv.exe	148
PID 2376 set thread context of 4832	2376	spoolsv.exe	150
PID 4804 set thread context of 4648	4804	spoolsv.exe	151
PID 2784 set thread context of 3336	2784	spoolsv.exe	152
PID 3636 set thread context of 2484	3636	spoolsv.exe	154
PID 2668 set thread context of 3064	2668	spoolsv.exe	156
PID 4080 set thread context of 5112	4080	spoolsv.exe	157
PID 5064 set thread context of 4504	5064	spoolsv.exe	158
PID 3008 set thread context of 3356	3008	spoolsv.exe	160
PID 4988 set thread context of 1608	4988	spoolsv.exe	162
PID 3040 set thread context of 4036	3040	spoolsv.exe	163
PID 5040 set thread context of 4468	5040	spoolsv.exe	165
PID 4972 set thread context of 4620	4972	spoolsv.exe	169
PID 3984 set thread context of 4008	3984	explorer.exe	172
PID 2660 set thread context of 4156	2660	spoolsv.exe	175
PID 3848 set thread context of 1420	3848	explorer.exe	178
PID 2500 set thread context of 2248	2500	spoolsv.exe	181
PID 1368 set thread context of 4932	1368	explorer.exe	183
PID 3016 set thread context of 1352	3016	spoolsv.exe	186
PID 3548 set thread context of 2164	3548	explorer.exe	188
PID 2260 set thread context of 3312	2260	spoolsv.exe	191
PID 3540 set thread context of 3868	3540	explorer.exe	193
PID 4568 set thread context of 4108	4568	explorer.exe	196
PID 3916 set thread context of 2892	3916	spoolsv.exe	197
PID 3624 set thread context of 1632	3624	spoolsv.exe	202
PID 1852 set thread context of 412	1852	explorer.exe	204
PID 2516 set thread context of 3020	2516	spoolsv.exe	205
PID 1672 set thread context of 4108	1672	explorer.exe	206
PID 3664 set thread context of 2708	3664	spoolsv.exe	207
PID 3292 set thread context of 4792	3292	spoolsv.exe	209
PID 4340 set thread context of 4884	4340	spoolsv.exe	211
PID 1960 set thread context of 3424	1960	explorer.exe	212
PID 1020 set thread context of 4440	1020	spoolsv.exe	214

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3500	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
3500	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3500	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
3500	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2404	explorer.exe
2348	spoolsv.exe
2348	spoolsv.exe
1208	spoolsv.exe
1208	spoolsv.exe
1100	spoolsv.exe
1100	spoolsv.exe
1428	spoolsv.exe
1428	spoolsv.exe
2640	spoolsv.exe
2640	spoolsv.exe
1136	spoolsv.exe
1136	spoolsv.exe
4676	spoolsv.exe
4676	spoolsv.exe
1684	spoolsv.exe
1684	spoolsv.exe
4368	spoolsv.exe
4368	spoolsv.exe
924	spoolsv.exe
924	spoolsv.exe
4828	spoolsv.exe
4828	spoolsv.exe
3800	spoolsv.exe
3800	spoolsv.exe
1584	spoolsv.exe
1584	spoolsv.exe
4604	spoolsv.exe
4604	spoolsv.exe
3508	spoolsv.exe
3508	spoolsv.exe
4528	spoolsv.exe
4528	spoolsv.exe
1876	spoolsv.exe
1876	spoolsv.exe
4820	spoolsv.exe
4820	spoolsv.exe
4832	spoolsv.exe
4832	spoolsv.exe
4648	spoolsv.exe
4648	spoolsv.exe
3336	spoolsv.exe
3336	spoolsv.exe
2484	spoolsv.exe
2484	spoolsv.exe
3064	spoolsv.exe
3064	spoolsv.exe
5112	spoolsv.exe
5112	spoolsv.exe
4504	spoolsv.exe
4504	spoolsv.exe
3356	spoolsv.exe
3356	spoolsv.exe
1608	spoolsv.exe
1608	spoolsv.exe
4036	spoolsv.exe
4036	spoolsv.exe
4468	spoolsv.exe
4468	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4688	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	81
PID 4444 wrote to memory of 4688	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	81
PID 4444 wrote to memory of 3500	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	83
PID 4444 wrote to memory of 3500	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	83
PID 4444 wrote to memory of 3500	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	83
PID 4444 wrote to memory of 3500	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	83
PID 4444 wrote to memory of 3500	4444	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	83
PID 3500 wrote to memory of 1804	3500	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	84
PID 3500 wrote to memory of 1804	3500	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	84
PID 3500 wrote to memory of 1804	3500	ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe	84
PID 1804 wrote to memory of 2404	1804	explorer.exe	92
PID 1804 wrote to memory of 2404	1804	explorer.exe	92
PID 1804 wrote to memory of 2404	1804	explorer.exe	92
PID 1804 wrote to memory of 2404	1804	explorer.exe	92
PID 1804 wrote to memory of 2404	1804	explorer.exe	92
PID 2404 wrote to memory of 2320	2404	explorer.exe	93
PID 2404 wrote to memory of 2320	2404	explorer.exe	93
PID 2404 wrote to memory of 2320	2404	explorer.exe	93
PID 2404 wrote to memory of 1432	2404	explorer.exe	94
PID 2404 wrote to memory of 1432	2404	explorer.exe	94
PID 2404 wrote to memory of 1432	2404	explorer.exe	94
PID 2404 wrote to memory of 2928	2404	explorer.exe	95
PID 2404 wrote to memory of 2928	2404	explorer.exe	95
PID 2404 wrote to memory of 2928	2404	explorer.exe	95
PID 2404 wrote to memory of 4808	2404	explorer.exe	96
PID 2404 wrote to memory of 4808	2404	explorer.exe	96
PID 2404 wrote to memory of 4808	2404	explorer.exe	96
PID 2404 wrote to memory of 4540	2404	explorer.exe	97
PID 2404 wrote to memory of 4540	2404	explorer.exe	97
PID 2404 wrote to memory of 4540	2404	explorer.exe	97
PID 2404 wrote to memory of 1668	2404	explorer.exe	98
PID 2404 wrote to memory of 1668	2404	explorer.exe	98
PID 2404 wrote to memory of 1668	2404	explorer.exe	98
PID 2404 wrote to memory of 1760	2404	explorer.exe	99
PID 2404 wrote to memory of 1760	2404	explorer.exe	99
PID 2404 wrote to memory of 1760	2404	explorer.exe	99
PID 2404 wrote to memory of 2140	2404	explorer.exe	100
PID 2404 wrote to memory of 2140	2404	explorer.exe	100
PID 2404 wrote to memory of 2140	2404	explorer.exe	100
PID 2404 wrote to memory of 4656	2404	explorer.exe	101
PID 2404 wrote to memory of 4656	2404	explorer.exe	101
PID 2404 wrote to memory of 4656	2404	explorer.exe	101
PID 2404 wrote to memory of 3944	2404	explorer.exe	102
PID 2404 wrote to memory of 3944	2404	explorer.exe	102
PID 2404 wrote to memory of 3944	2404	explorer.exe	102
PID 2404 wrote to memory of 4448	2404	explorer.exe	103
PID 2404 wrote to memory of 4448	2404	explorer.exe	103
PID 2404 wrote to memory of 4448	2404	explorer.exe	103
PID 2404 wrote to memory of 4176	2404	explorer.exe	104
PID 2404 wrote to memory of 4176	2404	explorer.exe	104
PID 2404 wrote to memory of 4176	2404	explorer.exe	104
PID 2404 wrote to memory of 4460	2404	explorer.exe	105
PID 2404 wrote to memory of 4460	2404	explorer.exe	105
PID 2404 wrote to memory of 4460	2404	explorer.exe	105
PID 2404 wrote to memory of 2592	2404	explorer.exe	106
PID 2404 wrote to memory of 2592	2404	explorer.exe	106
PID 2404 wrote to memory of 2592	2404	explorer.exe	106
PID 2404 wrote to memory of 4408	2404	explorer.exe	107
PID 2404 wrote to memory of 4408	2404	explorer.exe	107
PID 2404 wrote to memory of 4408	2404	explorer.exe	107
PID 2404 wrote to memory of 1604	2404	explorer.exe	108
PID 2404 wrote to memory of 1604	2404	explorer.exe	108
PID 2404 wrote to memory of 1604	2404	explorer.exe	108
PID 2404 wrote to memory of 4216	2404	explorer.exe	109

C:\Users\Admin\AppData\Local\Temp\ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ab0392e3501ee064242562eb651b5cee_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3500
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3984
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4540
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3848
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4368
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1368
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3548
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4708
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3540
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2376
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2784
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3636
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2484
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4568
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3008
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3356
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1852
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4468
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1672
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1960
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4324
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3312
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2892
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3624
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4792
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4440
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2596
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 898e5db7b7e27fe97e95d44c044008fb66cc581dead5033920ca73062e5aa7fd
MD5 a22f956ca7ad66ed3a925b210b1a2bba
SHA1 3067df16244ed0c610366c4024460749f9ebf0e9
SHA512 d69c7be613f55faf72e4fbe01c466b28119336621d1a8ff0ebe143a2028a804e1910e0b9be41f83945a48858e07261ccc2092a4b642387c4546a6748980f443a
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 ead379859efc1a288c671989582a7ab613b22ffa546f11f897e97d81a21e4c5e
MD5 20c4b3f6b8044401c3babc88c2d8a1ce
SHA1 127fd39744409ca285a2a545efa44be14e0e62ec
SHA512 1b26ddde8bb158be072d0328f51e5c5d59a2930c429914c25e9ca67526eb099617cc67f9c052bdd29f9d711cc6efdbcca73e66e33cbc0c97e5b5ebb6677c60df
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZb:0UzeyQMS4DqodCnoe+iitjWwwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-5348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/400-5240-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/412-4718-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/924-2227-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/924-2224-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1100-1964-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1136-2118-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1136-2290-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1208-1953-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/1208-1955-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1352-4130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1352-3993-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1420-3739-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-1991-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1432-970-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1432-1956-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1604-1837-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1608-2975-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1632-4878-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1632-4709-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1668-1154-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1684-2140-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1760-1155-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1804-64-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1804-69-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1876-2494-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2140-1301-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2164-4003-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2248-3829-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2248-3902-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2320-1945-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2320-784-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2348-2100-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2348-1944-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2376-1942-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2396-5458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2404-68-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2404-783-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2484-2933-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2592-1652-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2640-2056-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2668-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2784-1949-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2928-1965-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2928-971-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3020-4728-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3020-4725-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3064-2857-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3312-4217-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3336-2678-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3356-2965-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3424-4918-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3500-28-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3500-58-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3500-24-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3636-1963-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3800-2319-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3868-4227-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3944-1465-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4008-3347-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4036-2982-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4044-5093-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4108-4438-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4108-4738-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4156-3551-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4156-3659-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4176-1467-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4216-1838-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4368-2215-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4408-1653-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4440-5072-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4444-23-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/4444-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4444-0-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/4444-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4448-1466-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4460-1651-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4468-3171-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4468-3098-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4504-2878-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4528-2485-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4540-1153-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4604-2420-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4604-2416-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4620-3454-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4620-3282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4648-2668-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4656-1302-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4676-2127-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-1839-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4792-4898-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4792-5051-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4804-1943-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4808-972-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4820-2649-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-2831-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4828-2308-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4828-2458-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4884-4906-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4920-5084-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4920-5080-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-3849-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-2862-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5112-2868-0x0000000000400000-0x000000000043E000-memory.dmp

Download