pony | 78d6ef4d62a54906add7d78006005bfd05ea86a5f54353fe551aacf45ba39f09

Analysis

max time kernel
148s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
Size 2.2MB
Sample240615-ft86lszcme
SHA256 78d6ef4d62a54906add7d78006005bfd05ea86a5f54353fe551aacf45ba39f09
MD5 acfb7a5f90d67045eae1da79f4cac7a6
SHA1 91e09057470a0f42c558b39f0c75eeedce38aecd
SHA512 d7ce9f85f40145b941c83c09592281b1ddc9b8a0f2ab225a2ede141f7062fcb93c2ae9e9c3dfaeda2ed77f96250fe050cb1233997404f27f30ac5a533b7d3d4d
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2032	explorer.exe
3212	explorer.exe
2772	spoolsv.exe
4480	spoolsv.exe
2108	spoolsv.exe
2612	spoolsv.exe
4080	spoolsv.exe
456	spoolsv.exe
2928	spoolsv.exe
2160	spoolsv.exe
1176	spoolsv.exe
1556	spoolsv.exe
3772	spoolsv.exe
2724	spoolsv.exe
4876	spoolsv.exe
3276	spoolsv.exe
2652	spoolsv.exe
4216	spoolsv.exe
556	spoolsv.exe
3992	spoolsv.exe
2016	spoolsv.exe
4888	spoolsv.exe
4976	spoolsv.exe
1528	spoolsv.exe
2004	spoolsv.exe
1032	spoolsv.exe
4124	spoolsv.exe
5028	spoolsv.exe
4060	spoolsv.exe
1592	spoolsv.exe
1456	spoolsv.exe
3240	spoolsv.exe
3980	spoolsv.exe
3204	explorer.exe
1968	spoolsv.exe
940	spoolsv.exe
3248	spoolsv.exe
2244	spoolsv.exe
1964	spoolsv.exe
3192	spoolsv.exe
3676	explorer.exe
5064	spoolsv.exe
3624	spoolsv.exe
3016	spoolsv.exe
3572	spoolsv.exe
3308	spoolsv.exe
1132	explorer.exe
1856	spoolsv.exe
3144	spoolsv.exe
4704	spoolsv.exe
5000	spoolsv.exe
3972	spoolsv.exe
2684	spoolsv.exe
2168	explorer.exe
4420	spoolsv.exe
1424	spoolsv.exe
528	spoolsv.exe
1524	spoolsv.exe
4776	spoolsv.exe
396	explorer.exe
3160	spoolsv.exe
3024	spoolsv.exe
464	spoolsv.exe
1268	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 55 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 4900	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	86
PID 2032 set thread context of 3212	2032	explorer.exe	95
PID 2772 set thread context of 3980	2772	spoolsv.exe	126
PID 4480 set thread context of 1968	4480	spoolsv.exe	128
PID 2108 set thread context of 940	2108	spoolsv.exe	129
PID 2612 set thread context of 2244	2612	spoolsv.exe	131
PID 4080 set thread context of 1964	4080	spoolsv.exe	132
PID 456 set thread context of 3192	456	spoolsv.exe	133
PID 2928 set thread context of 5064	2928	spoolsv.exe	135
PID 2160 set thread context of 3624	2160	spoolsv.exe	136
PID 1176 set thread context of 3572	1176	spoolsv.exe	138
PID 1556 set thread context of 3308	1556	spoolsv.exe	139
PID 3772 set thread context of 1856	3772	spoolsv.exe	141
PID 2724 set thread context of 3144	2724	spoolsv.exe	142
PID 4876 set thread context of 4704	4876	spoolsv.exe	143
PID 3276 set thread context of 3972	3276	spoolsv.exe	145
PID 2652 set thread context of 2684	2652	spoolsv.exe	146
PID 4216 set thread context of 4420	4216	spoolsv.exe	148
PID 556 set thread context of 1424	556	spoolsv.exe	149
PID 3992 set thread context of 528	3992	spoolsv.exe	150
PID 2016 set thread context of 4776	2016	spoolsv.exe	152
PID 4888 set thread context of 3160	4888	spoolsv.exe	154
PID 4976 set thread context of 3024	4976	spoolsv.exe	155
PID 1528 set thread context of 464	1528	spoolsv.exe	156
PID 2004 set thread context of 1268	2004	spoolsv.exe	157
PID 1032 set thread context of 4152	1032	spoolsv.exe	159
PID 4124 set thread context of 2116	4124	spoolsv.exe	161
PID 5028 set thread context of 4916	5028	spoolsv.exe	162
PID 4060 set thread context of 3788	4060	spoolsv.exe	163
PID 1592 set thread context of 5016	1592	spoolsv.exe	165
PID 1456 set thread context of 852	1456	spoolsv.exe	167
PID 3240 set thread context of 4708	3240	spoolsv.exe	170
PID 3204 set thread context of 3300	3204	explorer.exe	174
PID 3248 set thread context of 1568	3248	spoolsv.exe	177
PID 3676 set thread context of 4672	3676	explorer.exe	179
PID 3016 set thread context of 4620	3016	spoolsv.exe	183
PID 1132 set thread context of 908	1132	explorer.exe	185
PID 5000 set thread context of 3636	5000	spoolsv.exe	189
PID 2168 set thread context of 696	2168	explorer.exe	192
PID 1524 set thread context of 1092	1524	spoolsv.exe	196
PID 396 set thread context of 2696	396	explorer.exe	198
PID 564 set thread context of 4952	564	explorer.exe	201
PID 2236 set thread context of 1760	2236	spoolsv.exe	202
PID 1444 set thread context of 400	1444	spoolsv.exe	206
PID 4332 set thread context of 2476	4332	explorer.exe	208
PID 3424 set thread context of 1264	3424	spoolsv.exe	209
PID 5096 set thread context of 1432	5096	spoolsv.exe	210
PID 4028 set thread context of 4608	4028	explorer.exe	211
PID 4388 set thread context of 1196	4388	spoolsv.exe	213
PID 3320 set thread context of 2388	3320	spoolsv.exe	215
PID 5036 set thread context of 2664	5036	spoolsv.exe	217
PID 4044 set thread context of 1232	4044	spoolsv.exe	218
PID 3692 set thread context of 4032	3692	explorer.exe	220
PID 1140 set thread context of 1240	1140	spoolsv.exe	221
PID 4088 set thread context of 4296	4088	spoolsv.exe	223

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4900	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
4900	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3212	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4900	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
4900	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3212	explorer.exe
3980	spoolsv.exe
3980	spoolsv.exe
1968	spoolsv.exe
1968	spoolsv.exe
940	spoolsv.exe
940	spoolsv.exe
2244	spoolsv.exe
2244	spoolsv.exe
1964	spoolsv.exe
1964	spoolsv.exe
3192	spoolsv.exe
3192	spoolsv.exe
5064	spoolsv.exe
5064	spoolsv.exe
3624	spoolsv.exe
3624	spoolsv.exe
3572	spoolsv.exe
3572	spoolsv.exe
3308	spoolsv.exe
3308	spoolsv.exe
1856	spoolsv.exe
1856	spoolsv.exe
3144	spoolsv.exe
3144	spoolsv.exe
4704	spoolsv.exe
4704	spoolsv.exe
3972	spoolsv.exe
3972	spoolsv.exe
2684	spoolsv.exe
2684	spoolsv.exe
4420	spoolsv.exe
4420	spoolsv.exe
1424	spoolsv.exe
1424	spoolsv.exe
528	spoolsv.exe
528	spoolsv.exe
4776	spoolsv.exe
4776	spoolsv.exe
3160	spoolsv.exe
3160	spoolsv.exe
3024	spoolsv.exe
3024	spoolsv.exe
464	spoolsv.exe
464	spoolsv.exe
1268	spoolsv.exe
1268	spoolsv.exe
4152	spoolsv.exe
4152	spoolsv.exe
2116	spoolsv.exe
2116	spoolsv.exe
4916	spoolsv.exe
4916	spoolsv.exe
3788	spoolsv.exe
3788	spoolsv.exe
5016	spoolsv.exe
5016	spoolsv.exe
852	spoolsv.exe
852	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4644	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	81
PID 536 wrote to memory of 4644	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	81
PID 536 wrote to memory of 4900	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	86
PID 536 wrote to memory of 4900	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	86
PID 536 wrote to memory of 4900	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	86
PID 536 wrote to memory of 4900	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	86
PID 536 wrote to memory of 4900	536	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	86
PID 4900 wrote to memory of 2032	4900	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	87
PID 4900 wrote to memory of 2032	4900	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	87
PID 4900 wrote to memory of 2032	4900	acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe	87
PID 2032 wrote to memory of 3212	2032	explorer.exe	95
PID 2032 wrote to memory of 3212	2032	explorer.exe	95
PID 2032 wrote to memory of 3212	2032	explorer.exe	95
PID 2032 wrote to memory of 3212	2032	explorer.exe	95
PID 2032 wrote to memory of 3212	2032	explorer.exe	95
PID 3212 wrote to memory of 2772	3212	explorer.exe	96
PID 3212 wrote to memory of 2772	3212	explorer.exe	96
PID 3212 wrote to memory of 2772	3212	explorer.exe	96
PID 3212 wrote to memory of 4480	3212	explorer.exe	97
PID 3212 wrote to memory of 4480	3212	explorer.exe	97
PID 3212 wrote to memory of 4480	3212	explorer.exe	97
PID 3212 wrote to memory of 2108	3212	explorer.exe	98
PID 3212 wrote to memory of 2108	3212	explorer.exe	98
PID 3212 wrote to memory of 2108	3212	explorer.exe	98
PID 3212 wrote to memory of 2612	3212	explorer.exe	99
PID 3212 wrote to memory of 2612	3212	explorer.exe	99
PID 3212 wrote to memory of 2612	3212	explorer.exe	99
PID 3212 wrote to memory of 4080	3212	explorer.exe	100
PID 3212 wrote to memory of 4080	3212	explorer.exe	100
PID 3212 wrote to memory of 4080	3212	explorer.exe	100
PID 3212 wrote to memory of 456	3212	explorer.exe	101
PID 3212 wrote to memory of 456	3212	explorer.exe	101
PID 3212 wrote to memory of 456	3212	explorer.exe	101
PID 3212 wrote to memory of 2928	3212	explorer.exe	102
PID 3212 wrote to memory of 2928	3212	explorer.exe	102
PID 3212 wrote to memory of 2928	3212	explorer.exe	102
PID 3212 wrote to memory of 2160	3212	explorer.exe	103
PID 3212 wrote to memory of 2160	3212	explorer.exe	103
PID 3212 wrote to memory of 2160	3212	explorer.exe	103
PID 3212 wrote to memory of 1176	3212	explorer.exe	104
PID 3212 wrote to memory of 1176	3212	explorer.exe	104
PID 3212 wrote to memory of 1176	3212	explorer.exe	104
PID 3212 wrote to memory of 1556	3212	explorer.exe	105
PID 3212 wrote to memory of 1556	3212	explorer.exe	105
PID 3212 wrote to memory of 1556	3212	explorer.exe	105
PID 3212 wrote to memory of 3772	3212	explorer.exe	106
PID 3212 wrote to memory of 3772	3212	explorer.exe	106
PID 3212 wrote to memory of 3772	3212	explorer.exe	106
PID 3212 wrote to memory of 2724	3212	explorer.exe	107
PID 3212 wrote to memory of 2724	3212	explorer.exe	107
PID 3212 wrote to memory of 2724	3212	explorer.exe	107
PID 3212 wrote to memory of 4876	3212	explorer.exe	108
PID 3212 wrote to memory of 4876	3212	explorer.exe	108
PID 3212 wrote to memory of 4876	3212	explorer.exe	108
PID 3212 wrote to memory of 3276	3212	explorer.exe	109
PID 3212 wrote to memory of 3276	3212	explorer.exe	109
PID 3212 wrote to memory of 3276	3212	explorer.exe	109
PID 3212 wrote to memory of 2652	3212	explorer.exe	110
PID 3212 wrote to memory of 2652	3212	explorer.exe	110
PID 3212 wrote to memory of 2652	3212	explorer.exe	110
PID 3212 wrote to memory of 4216	3212	explorer.exe	111
PID 3212 wrote to memory of 4216	3212	explorer.exe	111
PID 3212 wrote to memory of 4216	3212	explorer.exe	111
PID 3212 wrote to memory of 556	3212	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\acfb7a5f90d67045eae1da79f4cac7a6_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4900
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3980
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3204
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2108
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2612
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3192
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3676
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2160
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1132
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2724
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3276
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2652
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2168
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3992
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4776
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:396
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4152
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:564
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4124
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5016
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4332
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1456
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        
        PID:4028
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3248
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1568
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3692
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3232
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3636
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1524
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1760
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5096
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1196
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:1004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5036
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1232
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1240
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Parameters.ini

Path C:\Windows\Parameters.ini
Size 74B
SHA256 3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
MD5 6687785d6a31cdf9a5f80acb3abc459b
SHA1 1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA512 5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 2.2MB
SHA256 c818cba02ead4c716051a02482f4f543637c9f6b1db4c01ebde85c23d2d4dfd8
MD5 d6bc1d9f6fe1faa8cfdec1fc69f1c35c
SHA1 f3ad66ab320037c3d4364b98ff3315aff9ef7f7a
SHA512 6f8ba280bb9c4835f0487693cfb94d3b5b2eda0de7ef2a13b1ba9df2824aa73a03d66c1480b4f7a8b5d3e8a2fd0e4dff628d6b64ad4eb1633a5b61b5d3a5051b
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 2.2MB
SHA256 91e32f91c6efc8728d214b8f112d96df263375c93115d356b922d6af79593767
MD5 82cc5b81fd053f004fcb91e8193b66ba
SHA1 0545eb9e77c5a9e289b4d8fe738fb7f6e05425b9
SHA512 e5e47714e198858b97003b71be1463906c0034446e152096bc44cb21a142b91aa46505ed10dc31ebcbbb227886a3db2620e624b79d11d0648c468c996881f204
SSDEEP 24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ9:0UzeyQMS4DqodCnoe+iitjWwwh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-4686-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/456-1205-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/464-2775-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/464-2778-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/528-2599-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/536-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/536-33-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/536-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/536-31-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/556-1888-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/696-4067-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/696-4069-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/852-3062-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/852-3059-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/908-3754-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/940-1994-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1092-4280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1176-1393-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1196-5026-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1196-4862-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1232-5047-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1232-5205-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1240-5068-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1264-4705-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1268-2786-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1424-2588-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1528-1998-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1556-1546-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1568-3541-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1568-3614-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1760-4604-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1856-2412-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1856-2407-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1964-2113-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1968-1984-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2004-2099-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2016-1973-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2032-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2032-95-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2108-1995-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2108-1007-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2116-2897-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2116-2899-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2160-1392-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2244-2101-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2244-2105-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2388-4881-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2476-4696-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2612-1008-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2652-1704-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2664-4991-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2684-2729-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2684-2573-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2696-4287-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2696-4290-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2724-1548-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2772-1976-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2772-840-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2928-1206-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3024-2768-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3160-2755-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3192-2381-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3192-2182-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-819-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3212-94-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3276-1703-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3300-3400-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3308-2399-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3308-2546-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3572-2308-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3624-2214-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3636-4050-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3772-1547-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/3788-2919-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3972-2553-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3980-1975-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3980-2169-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3992-1889-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4032-5057-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4080-1204-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4152-2969-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4152-2889-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4216-1887-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4296-5137-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4420-2580-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4480-1985-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4480-1006-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4608-4792-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4672-3551-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4704-2430-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-3324-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4708-3231-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4776-2861-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4776-2736-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4876-1702-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4888-1974-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/4900-72-0x0000000000440000-0x0000000000509000-memory.dmp

Download

memory/4900-34-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4900-36-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4900-79-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-2911-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-2907-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4952-4483-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4976-1983-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/5016-3050-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5016-3125-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5064-2201-0x0000000000400000-0x000000000043E000-memory.dmp

Download