pony | dd56ee2babfb0287073382e06c0604d6e12a25b4caf11012761fcda1ecdbcc77

Analysis

max time kernel
143s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
Size

2.2MB
MD5

ab4602b21622bdd9cc287d809b4d6709
SHA1

a00537abddc9116d5bc0ccafa8eb11e0d8222283
SHA256

dd56ee2babfb0287073382e06c0604d6e12a25b4caf11012761fcda1ecdbcc77
SHA512

722acfc74ff37e22624fd49bf4d853c37815e9f3f7e0577591451705f9e36303003b736c63f8e0bf94ba0faea9fb3b1ce0959f15e32d4b883d97d80dc71ec0a6
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwws

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
4620	explorer.exe
5088	explorer.exe
1060	spoolsv.exe
2320	spoolsv.exe
2400	spoolsv.exe
4724	spoolsv.exe
2424	spoolsv.exe
64	spoolsv.exe
3188	spoolsv.exe
4584	spoolsv.exe
840	spoolsv.exe
1516	spoolsv.exe
676	spoolsv.exe
1080	spoolsv.exe
3652	spoolsv.exe
1852	spoolsv.exe
4796	spoolsv.exe
5076	spoolsv.exe
4268	spoolsv.exe
1588	spoolsv.exe
4360	spoolsv.exe
4864	spoolsv.exe
4404	spoolsv.exe
3564	spoolsv.exe
1940	spoolsv.exe
2920	spoolsv.exe
1860	spoolsv.exe
1096	spoolsv.exe
2380	spoolsv.exe
3832	spoolsv.exe
1836	spoolsv.exe
3160	spoolsv.exe
4580	spoolsv.exe
4348	spoolsv.exe
4800	spoolsv.exe
4100	spoolsv.exe
3956	spoolsv.exe
1304	spoolsv.exe
4992	explorer.exe
3144	spoolsv.exe
2392	spoolsv.exe
2632	spoolsv.exe
2916	spoolsv.exe
2944	spoolsv.exe
2504	spoolsv.exe
2276	spoolsv.exe
3512	spoolsv.exe
1004	spoolsv.exe
4596	spoolsv.exe
620	explorer.exe
5032	spoolsv.exe
3872	spoolsv.exe
1464	spoolsv.exe
3656	spoolsv.exe
1956	spoolsv.exe
3944	spoolsv.exe
1772	spoolsv.exe
1052	explorer.exe
3624	spoolsv.exe
2868	spoolsv.exe
2452	spoolsv.exe
1152	spoolsv.exe
4448	spoolsv.exe
3212	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 2832 set thread context of 5000	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	86
PID 4620 set thread context of 5088	4620	explorer.exe	91
PID 1060 set thread context of 1304	1060	spoolsv.exe	127
PID 2320 set thread context of 3144	2320	spoolsv.exe	129
PID 2400 set thread context of 2392	2400	spoolsv.exe	130
PID 4724 set thread context of 2916	4724	spoolsv.exe	132
PID 2424 set thread context of 2944	2424	spoolsv.exe	133
PID 64 set thread context of 2504	64	spoolsv.exe	134
PID 3188 set thread context of 2276	3188	spoolsv.exe	135
PID 4584 set thread context of 3512	4584	spoolsv.exe	136
PID 840 set thread context of 1004	840	spoolsv.exe	137
PID 1516 set thread context of 4596	1516	spoolsv.exe	138
PID 676 set thread context of 3872	676	spoolsv.exe	141
PID 1080 set thread context of 1464	1080	spoolsv.exe	142
PID 3652 set thread context of 3656	3652	spoolsv.exe	143
PID 1852 set thread context of 1956	1852	spoolsv.exe	144
PID 4796 set thread context of 3944	4796	spoolsv.exe	145
PID 5076 set thread context of 1772	5076	spoolsv.exe	146
PID 4268 set thread context of 3624	4268	spoolsv.exe	148
PID 1588 set thread context of 2452	1588	spoolsv.exe	150
PID 4360 set thread context of 1152	4360	spoolsv.exe	151
PID 4864 set thread context of 4448	4864	spoolsv.exe	152
PID 4404 set thread context of 3212	4404	spoolsv.exe	153
PID 3564 set thread context of 2060	3564	spoolsv.exe	154
PID 1940 set thread context of 2580	1940	spoolsv.exe	155
PID 2920 set thread context of 4932	2920	spoolsv.exe	158
PID 1860 set thread context of 1672	1860	spoolsv.exe	159
PID 1096 set thread context of 3348	1096	spoolsv.exe	160
PID 2380 set thread context of 3536	2380	spoolsv.exe	162
PID 3832 set thread context of 4224	3832	spoolsv.exe	164
PID 1836 set thread context of 4084	1836	spoolsv.exe	165
PID 3160 set thread context of 5060	3160	spoolsv.exe	166
PID 4580 set thread context of 2896	4580	spoolsv.exe	167
PID 4348 set thread context of 1692	4348	spoolsv.exe	169
PID 4800 set thread context of 4280	4800	spoolsv.exe	170
PID 4100 set thread context of 1248	4100	spoolsv.exe	171
PID 3956 set thread context of 452	3956	spoolsv.exe	176
PID 4992 set thread context of 4976	4992	explorer.exe	181
PID 2632 set thread context of 2636	2632	spoolsv.exe	182
PID 620 set thread context of 2396	620	explorer.exe	188
PID 5032 set thread context of 4756	5032	spoolsv.exe	191
PID 1052 set thread context of 3632	1052	explorer.exe	197
PID 2868 set thread context of 2088	2868	spoolsv.exe	198
PID 404 set thread context of 4792	404	explorer.exe	202
PID 4968 set thread context of 2760	4968	spoolsv.exe	204
PID 3924 set thread context of 2860	3924	spoolsv.exe	210
PID 1780 set thread context of 3280	1780	explorer.exe	213
PID 4128 set thread context of 788	4128	spoolsv.exe	214
PID 2704 set thread context of 2300	2704	explorer.exe	215
PID 4192 set thread context of 348	4192	spoolsv.exe	216
PID 1748 set thread context of 4092	1748	spoolsv.exe	217
PID 5108 set thread context of 1676	5108	spoolsv.exe	223
PID 3544 set thread context of 4528	3544	explorer.exe	221
PID 3372 set thread context of 3644	3372	spoolsv.exe	222
PID 3416 set thread context of 2832	3416	spoolsv.exe	225

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5000	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
5000	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5088	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5000	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
5000	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
5088	explorer.exe
1304	spoolsv.exe
1304	spoolsv.exe
3144	spoolsv.exe
3144	spoolsv.exe
2392	spoolsv.exe
2392	spoolsv.exe
2916	spoolsv.exe
2916	spoolsv.exe
2944	spoolsv.exe
2944	spoolsv.exe
2504	spoolsv.exe
2504	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe
3512	spoolsv.exe
3512	spoolsv.exe
1004	spoolsv.exe
1004	spoolsv.exe
4596	spoolsv.exe
4596	spoolsv.exe
3872	spoolsv.exe
3872	spoolsv.exe
1464	spoolsv.exe
1464	spoolsv.exe
3656	spoolsv.exe
3656	spoolsv.exe
1956	spoolsv.exe
1956	spoolsv.exe
3944	spoolsv.exe
3944	spoolsv.exe
1772	spoolsv.exe
1772	spoolsv.exe
3624	spoolsv.exe
3624	spoolsv.exe
2452	spoolsv.exe
2452	spoolsv.exe
1152	spoolsv.exe
1152	spoolsv.exe
4448	spoolsv.exe
4448	spoolsv.exe
3212	spoolsv.exe
3212	spoolsv.exe
2060	spoolsv.exe
2060	spoolsv.exe
2580	spoolsv.exe
2580	spoolsv.exe
4932	spoolsv.exe
4932	spoolsv.exe
1672	spoolsv.exe
1672	spoolsv.exe
3348	spoolsv.exe
3348	spoolsv.exe
3536	spoolsv.exe
3536	spoolsv.exe
4224	spoolsv.exe
4224	spoolsv.exe
4084	spoolsv.exe
4084	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3412	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	81
PID 2832 wrote to memory of 3412	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	81
PID 2832 wrote to memory of 5000	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	86
PID 2832 wrote to memory of 5000	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	86
PID 2832 wrote to memory of 5000	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	86
PID 2832 wrote to memory of 5000	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	86
PID 2832 wrote to memory of 5000	2832	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	86
PID 5000 wrote to memory of 4620	5000	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	87
PID 5000 wrote to memory of 4620	5000	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	87
PID 5000 wrote to memory of 4620	5000	ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe	87
PID 4620 wrote to memory of 5088	4620	explorer.exe	91
PID 4620 wrote to memory of 5088	4620	explorer.exe	91
PID 4620 wrote to memory of 5088	4620	explorer.exe	91
PID 4620 wrote to memory of 5088	4620	explorer.exe	91
PID 4620 wrote to memory of 5088	4620	explorer.exe	91
PID 5088 wrote to memory of 1060	5088	explorer.exe	92
PID 5088 wrote to memory of 1060	5088	explorer.exe	92
PID 5088 wrote to memory of 1060	5088	explorer.exe	92
PID 5088 wrote to memory of 2320	5088	explorer.exe	93
PID 5088 wrote to memory of 2320	5088	explorer.exe	93
PID 5088 wrote to memory of 2320	5088	explorer.exe	93
PID 5088 wrote to memory of 2400	5088	explorer.exe	94
PID 5088 wrote to memory of 2400	5088	explorer.exe	94
PID 5088 wrote to memory of 2400	5088	explorer.exe	94
PID 5088 wrote to memory of 4724	5088	explorer.exe	95
PID 5088 wrote to memory of 4724	5088	explorer.exe	95
PID 5088 wrote to memory of 4724	5088	explorer.exe	95
PID 5088 wrote to memory of 2424	5088	explorer.exe	96
PID 5088 wrote to memory of 2424	5088	explorer.exe	96
PID 5088 wrote to memory of 2424	5088	explorer.exe	96
PID 5088 wrote to memory of 64	5088	explorer.exe	97
PID 5088 wrote to memory of 64	5088	explorer.exe	97
PID 5088 wrote to memory of 64	5088	explorer.exe	97
PID 5088 wrote to memory of 3188	5088	explorer.exe	98
PID 5088 wrote to memory of 3188	5088	explorer.exe	98
PID 5088 wrote to memory of 3188	5088	explorer.exe	98
PID 5088 wrote to memory of 4584	5088	explorer.exe	99
PID 5088 wrote to memory of 4584	5088	explorer.exe	99
PID 5088 wrote to memory of 4584	5088	explorer.exe	99
PID 5088 wrote to memory of 840	5088	explorer.exe	100
PID 5088 wrote to memory of 840	5088	explorer.exe	100
PID 5088 wrote to memory of 840	5088	explorer.exe	100
PID 5088 wrote to memory of 1516	5088	explorer.exe	101
PID 5088 wrote to memory of 1516	5088	explorer.exe	101
PID 5088 wrote to memory of 1516	5088	explorer.exe	101
PID 5088 wrote to memory of 676	5088	explorer.exe	102
PID 5088 wrote to memory of 676	5088	explorer.exe	102
PID 5088 wrote to memory of 676	5088	explorer.exe	102
PID 5088 wrote to memory of 1080	5088	explorer.exe	103
PID 5088 wrote to memory of 1080	5088	explorer.exe	103
PID 5088 wrote to memory of 1080	5088	explorer.exe	103
PID 5088 wrote to memory of 3652	5088	explorer.exe	104
PID 5088 wrote to memory of 3652	5088	explorer.exe	104
PID 5088 wrote to memory of 3652	5088	explorer.exe	104
PID 5088 wrote to memory of 1852	5088	explorer.exe	105
PID 5088 wrote to memory of 1852	5088	explorer.exe	105
PID 5088 wrote to memory of 1852	5088	explorer.exe	105
PID 5088 wrote to memory of 4796	5088	explorer.exe	106
PID 5088 wrote to memory of 4796	5088	explorer.exe	106
PID 5088 wrote to memory of 4796	5088	explorer.exe	106
PID 5088 wrote to memory of 5076	5088	explorer.exe	107
PID 5088 wrote to memory of 5076	5088	explorer.exe	107
PID 5088 wrote to memory of 5076	5088	explorer.exe	107
PID 5088 wrote to memory of 4268	5088	explorer.exe	108

C:\Users\Admin\AppData\Local\Temp\ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ab4602b21622bdd9cc287d809b4d6709_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5000
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4992
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4976
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2400
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3188
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4596
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:620
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:676
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3656
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1052
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4268
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1940
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:404
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1780
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3832
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4800
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1248
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2704
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:452
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2632
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3716
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1448
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4756
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2088
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2860
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:348
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3372
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3644
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3860
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3788
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3228
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
714b0407d885fbbdc0061b5dda059f6f

SHA1
4bd4d3bb047f0fed78a41e8032b93f20c8343996

SHA256
78ab590fe5c6d6aadae6535b92e0e7beeb6fee8ec68408ad7488f484a54160e4

SHA512
c3ddf75c50d98031ce6e4106091084d5035c4ef48ef22f2c5fa008c1888f524e26bf896eca69bd97547dd1c3c34efb8791b5829ecf5b23763624832b884407ee

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
51eb376a43624558ad35e8825b4e5e6f

SHA1
41fa07bc0e9b218da8e2e59059d7c31040107c3b

SHA256
15ed07c9bf1e0651255a49f1c061a63842a6070e3070214880e93c66ebf51c9b

SHA512
c03c0a6a409d1ebcef5d45041d15fcbd6f8db90fef1a77a22a614716d32cf3f302b0e2c9afdd5194ffb01f77b58755110eb9f239df4d8f3755e0285d54aaf646

Download Submit
memory/64-1429-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/452-3968-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-3880-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/676-1649-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/788-5615-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/788-5619-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/840-1647-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1004-2595-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-2428-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1060-1004-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1080-1857-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1152-3012-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1248-3725-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1248-3603-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1304-2645-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1304-2433-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1448-6280-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1464-2768-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1516-1648-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1588-2091-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1672-3236-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1772-2899-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1772-3114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1852-1859-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1860-2456-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1940-2432-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1956-2791-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1956-2788-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-3050-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-4900-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2088-5014-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2276-2575-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2300-5628-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2320-1200-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2320-2444-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2392-2452-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-2450-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/2396-4494-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2400-1201-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2400-2453-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2424-1428-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2504-2567-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2580-3177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2580-3289-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2636-4297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2760-5287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2832-0-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2832-53-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2832-6044-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2832-6041-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2832-57-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2832-51-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2860-5499-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2896-3442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2916-2543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2920-2440-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2944-2554-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3144-2443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3144-2441-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3188-1430-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3212-3031-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3280-5606-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3512-2585-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3536-3402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3564-2431-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3624-2908-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3632-4894-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3644-6118-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3644-5943-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3652-1858-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3656-2780-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3724-6420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3860-6318-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3860-6200-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3872-2760-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3944-2803-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4084-3421-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4092-5744-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4224-3408-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4268-2090-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4280-3536-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4280-3545-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4296-6263-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4360-2341-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4404-2343-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4528-5851-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4584-1431-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4596-2841-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4596-2689-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4620-99-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4620-104-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4692-6432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4724-1202-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4756-4608-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4756-4735-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4792-5114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4796-2088-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4864-2342-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4976-4131-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5000-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5000-58-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5000-93-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5044-6352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5060-3430-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5076-2089-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5088-1003-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5088-103-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download