pony | 8ad436b44a8b9d7ff0c236d19c27fc97835a1145ab071076a2ab5fc38b9327ba

Analysis

max time kernel
150s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
Size

2.2MB
MD5

ae9c3532257fa39f147331bcdd7c717b
SHA1

e1fa732d821c181974cbcf6d928c7e1f8ec3a96e
SHA256

8ad436b44a8b9d7ff0c236d19c27fc97835a1145ab071076a2ab5fc38b9327ba
SHA512

7aaf5e9dfb432f828362ee5a20e0ed3f9f2cea7ced339eae1fe22be0c67649ad2629a6db3dfadb7d5fd00003c22b4dada76b84044f740c15124ce2d8a44f8ef9
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZv:0UzeyQMS4DqodCnoe+iitjWwwj

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2412	explorer.exe
3840	explorer.exe
3532	spoolsv.exe
2736	spoolsv.exe
1432	spoolsv.exe
1140	spoolsv.exe
2004	spoolsv.exe
4312	spoolsv.exe
2532	spoolsv.exe
4520	spoolsv.exe
2016	spoolsv.exe
4968	spoolsv.exe
4412	spoolsv.exe
1060	spoolsv.exe
3972	spoolsv.exe
4256	spoolsv.exe
3692	spoolsv.exe
4292	spoolsv.exe
3460	spoolsv.exe
4424	spoolsv.exe
5028	spoolsv.exe
1948	spoolsv.exe
4860	spoolsv.exe
4688	spoolsv.exe
2720	spoolsv.exe
1496	spoolsv.exe
4928	spoolsv.exe
1392	spoolsv.exe
3688	spoolsv.exe
1768	spoolsv.exe
3528	spoolsv.exe
3672	spoolsv.exe
4400	spoolsv.exe
2892	explorer.exe
672	spoolsv.exe
1212	spoolsv.exe
4556	spoolsv.exe
1444	spoolsv.exe
1880	explorer.exe
4876	spoolsv.exe
4864	spoolsv.exe
4872	spoolsv.exe
4960	spoolsv.exe
4140	spoolsv.exe
2440	spoolsv.exe
3632	spoolsv.exe
4016	explorer.exe
2124	spoolsv.exe
4668	spoolsv.exe
1248	spoolsv.exe
4092	spoolsv.exe
5080	spoolsv.exe
1404	explorer.exe
5016	spoolsv.exe
3400	spoolsv.exe
208	spoolsv.exe
4636	spoolsv.exe
2480	spoolsv.exe
2640	explorer.exe
3320	spoolsv.exe
3172	spoolsv.exe
2780	spoolsv.exe
60	spoolsv.exe
3872	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 51 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 5084	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	87
PID 2412 set thread context of 3840	2412	explorer.exe	96
PID 3532 set thread context of 4400	3532	spoolsv.exe	127
PID 2736 set thread context of 672	2736	spoolsv.exe	129
PID 1432 set thread context of 4556	1432	spoolsv.exe	131
PID 1140 set thread context of 1444	1140	spoolsv.exe	132
PID 2004 set thread context of 4876	2004	spoolsv.exe	134
PID 4312 set thread context of 4864	4312	spoolsv.exe	135
PID 2532 set thread context of 4872	2532	spoolsv.exe	136
PID 4520 set thread context of 4960	4520	spoolsv.exe	137
PID 2016 set thread context of 2440	2016	spoolsv.exe	139
PID 4968 set thread context of 3632	4968	spoolsv.exe	140
PID 4412 set thread context of 2124	4412	spoolsv.exe	142
PID 1060 set thread context of 4668	1060	spoolsv.exe	143
PID 3972 set thread context of 1248	3972	spoolsv.exe	144
PID 4256 set thread context of 5080	4256	spoolsv.exe	146
PID 3692 set thread context of 5016	3692	spoolsv.exe	148
PID 4292 set thread context of 3400	4292	spoolsv.exe	149
PID 3460 set thread context of 4636	3460	spoolsv.exe	151
PID 4424 set thread context of 2480	4424	spoolsv.exe	152
PID 5028 set thread context of 3320	5028	spoolsv.exe	154
PID 1948 set thread context of 3172	1948	spoolsv.exe	155
PID 4860 set thread context of 60	4860	spoolsv.exe	157
PID 4688 set thread context of 3872	4688	spoolsv.exe	158
PID 2720 set thread context of 4632	2720	spoolsv.exe	159
PID 1496 set thread context of 5048	1496	spoolsv.exe	161
PID 4928 set thread context of 3484	4928	spoolsv.exe	163
PID 1392 set thread context of 3012	1392	spoolsv.exe	164
PID 3688 set thread context of 3536	3688	spoolsv.exe	165
PID 1768 set thread context of 2612	1768	spoolsv.exe	168
PID 3528 set thread context of 2276	3528	spoolsv.exe	169
PID 3672 set thread context of 3956	3672	spoolsv.exe	171
PID 2892 set thread context of 3648	2892	explorer.exe	173
PID 1212 set thread context of 4912	1212	spoolsv.exe	177
PID 1880 set thread context of 2804	1880	explorer.exe	180
PID 4140 set thread context of 1708	4140	spoolsv.exe	183
PID 4016 set thread context of 768	4016	explorer.exe	185
PID 4092 set thread context of 4904	4092	spoolsv.exe	188
PID 1404 set thread context of 1296	1404	explorer.exe	192
PID 208 set thread context of 2104	208	spoolsv.exe	195
PID 2640 set thread context of 4280	2640	explorer.exe	198
PID 2780 set thread context of 1100	2780	spoolsv.exe	201
PID 3028 set thread context of 3392	3028	explorer.exe	205
PID 4304 set thread context of 5024	4304	spoolsv.exe	206
PID 3496 set thread context of 2528	3496	spoolsv.exe	209
PID 640 set thread context of 2020	640	explorer.exe	211
PID 1512 set thread context of 4748	1512	spoolsv.exe	214
PID 808 set thread context of 2732	808	explorer.exe	216
PID 3884 set thread context of 1784	3884	spoolsv.exe	218
PID 4580 set thread context of 1588	4580	spoolsv.exe	219
PID 4156 set thread context of 1904	4156	spoolsv.exe	221

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5084	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
5084	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3840	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5084	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
5084	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
3840	explorer.exe
4400	spoolsv.exe
4400	spoolsv.exe
672	spoolsv.exe
672	spoolsv.exe
4556	spoolsv.exe
4556	spoolsv.exe
1444	spoolsv.exe
1444	spoolsv.exe
4876	spoolsv.exe
4876	spoolsv.exe
4864	spoolsv.exe
4864	spoolsv.exe
4872	spoolsv.exe
4872	spoolsv.exe
4960	spoolsv.exe
4960	spoolsv.exe
2440	spoolsv.exe
2440	spoolsv.exe
3632	spoolsv.exe
3632	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
4668	spoolsv.exe
4668	spoolsv.exe
1248	spoolsv.exe
1248	spoolsv.exe
5080	spoolsv.exe
5080	spoolsv.exe
5016	spoolsv.exe
5016	spoolsv.exe
3400	spoolsv.exe
3400	spoolsv.exe
4636	spoolsv.exe
4636	spoolsv.exe
2480	spoolsv.exe
2480	spoolsv.exe
3320	spoolsv.exe
3320	spoolsv.exe
3172	spoolsv.exe
3172	spoolsv.exe
60	spoolsv.exe
60	spoolsv.exe
3872	spoolsv.exe
3872	spoolsv.exe
4632	spoolsv.exe
4632	spoolsv.exe
5048	spoolsv.exe
5048	spoolsv.exe
3484	spoolsv.exe
3484	spoolsv.exe
3012	spoolsv.exe
3012	spoolsv.exe
3536	spoolsv.exe
3536	spoolsv.exe
2612	spoolsv.exe
2612	spoolsv.exe
2276	spoolsv.exe
2276	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1944	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	82
PID 1932 wrote to memory of 1944	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	82
PID 1932 wrote to memory of 5084	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	87
PID 1932 wrote to memory of 5084	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	87
PID 1932 wrote to memory of 5084	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	87
PID 1932 wrote to memory of 5084	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	87
PID 1932 wrote to memory of 5084	1932	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	87
PID 5084 wrote to memory of 2412	5084	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	88
PID 5084 wrote to memory of 2412	5084	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	88
PID 5084 wrote to memory of 2412	5084	ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe	88
PID 2412 wrote to memory of 3840	2412	explorer.exe	96
PID 2412 wrote to memory of 3840	2412	explorer.exe	96
PID 2412 wrote to memory of 3840	2412	explorer.exe	96
PID 2412 wrote to memory of 3840	2412	explorer.exe	96
PID 2412 wrote to memory of 3840	2412	explorer.exe	96
PID 3840 wrote to memory of 3532	3840	explorer.exe	97
PID 3840 wrote to memory of 3532	3840	explorer.exe	97
PID 3840 wrote to memory of 3532	3840	explorer.exe	97
PID 3840 wrote to memory of 2736	3840	explorer.exe	98
PID 3840 wrote to memory of 2736	3840	explorer.exe	98
PID 3840 wrote to memory of 2736	3840	explorer.exe	98
PID 3840 wrote to memory of 1432	3840	explorer.exe	99
PID 3840 wrote to memory of 1432	3840	explorer.exe	99
PID 3840 wrote to memory of 1432	3840	explorer.exe	99
PID 3840 wrote to memory of 1140	3840	explorer.exe	100
PID 3840 wrote to memory of 1140	3840	explorer.exe	100
PID 3840 wrote to memory of 1140	3840	explorer.exe	100
PID 3840 wrote to memory of 2004	3840	explorer.exe	101
PID 3840 wrote to memory of 2004	3840	explorer.exe	101
PID 3840 wrote to memory of 2004	3840	explorer.exe	101
PID 3840 wrote to memory of 4312	3840	explorer.exe	102
PID 3840 wrote to memory of 4312	3840	explorer.exe	102
PID 3840 wrote to memory of 4312	3840	explorer.exe	102
PID 3840 wrote to memory of 2532	3840	explorer.exe	103
PID 3840 wrote to memory of 2532	3840	explorer.exe	103
PID 3840 wrote to memory of 2532	3840	explorer.exe	103
PID 3840 wrote to memory of 4520	3840	explorer.exe	104
PID 3840 wrote to memory of 4520	3840	explorer.exe	104
PID 3840 wrote to memory of 4520	3840	explorer.exe	104
PID 3840 wrote to memory of 2016	3840	explorer.exe	105
PID 3840 wrote to memory of 2016	3840	explorer.exe	105
PID 3840 wrote to memory of 2016	3840	explorer.exe	105
PID 3840 wrote to memory of 4968	3840	explorer.exe	106
PID 3840 wrote to memory of 4968	3840	explorer.exe	106
PID 3840 wrote to memory of 4968	3840	explorer.exe	106
PID 3840 wrote to memory of 4412	3840	explorer.exe	107
PID 3840 wrote to memory of 4412	3840	explorer.exe	107
PID 3840 wrote to memory of 4412	3840	explorer.exe	107
PID 3840 wrote to memory of 1060	3840	explorer.exe	108
PID 3840 wrote to memory of 1060	3840	explorer.exe	108
PID 3840 wrote to memory of 1060	3840	explorer.exe	108
PID 3840 wrote to memory of 3972	3840	explorer.exe	109
PID 3840 wrote to memory of 3972	3840	explorer.exe	109
PID 3840 wrote to memory of 3972	3840	explorer.exe	109
PID 3840 wrote to memory of 4256	3840	explorer.exe	110
PID 3840 wrote to memory of 4256	3840	explorer.exe	110
PID 3840 wrote to memory of 4256	3840	explorer.exe	110
PID 3840 wrote to memory of 3692	3840	explorer.exe	111
PID 3840 wrote to memory of 3692	3840	explorer.exe	111
PID 3840 wrote to memory of 3692	3840	explorer.exe	111
PID 3840 wrote to memory of 4292	3840	explorer.exe	112
PID 3840 wrote to memory of 4292	3840	explorer.exe	112
PID 3840 wrote to memory of 4292	3840	explorer.exe	112
PID 3840 wrote to memory of 3460	3840	explorer.exe	113

C:\Users\Admin\AppData\Local\Temp\ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ae9c3532257fa39f147331bcdd7c717b_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5084
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2892
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2736
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1880
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2804
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2532
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4412
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1060
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1404
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3692
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3400
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:60
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3028
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:640
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3956
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:808
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4936
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4140
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1708
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4092
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2104
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1100
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2416
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:4304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5024
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2528
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4748
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4580
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1904
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1504
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2292
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:536
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2252
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3080
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
87cd7d09be8f44e5136bffcd0ead7e98

SHA1
04ff5a7d9b114e5005ead7effafda29cd3a34f70

SHA256
64b00cca8f84d5e29afd21562041ff3395e518268ddd2c121a383d0dc6555e9f

SHA512
2a6753c0ef84b9e3d0c62c63dd767659f35e23f91f5f66588f6dabf3b055e5f29a36645eb1566fecd493e3794bfcf54a86f1136c8951722ec8974e4e95050761

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
3a7d5d886ee80e25e27374111e606dbf

SHA1
1c4b0789bba78ebd8591d68454f99b33a83e4130

SHA256
59245d598cd521e7427634b37392fb114eef5b3381e7704374f74b96cd511833

SHA512
b30af07fd1107011aa4f4aeb773acb8e40641f2bf60627239bcfcaba01bffce1e9956fb7b32b8491bce63bf2890724025fdd7631a812c814e9ea8a6031000155

Download Submit
memory/60-2734-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/672-1919-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/672-1920-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/768-3664-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/936-5249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1032-5304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1032-5307-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1060-1437-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1100-4671-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1100-4568-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1140-977-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1248-2347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1296-4100-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1432-976-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1432-2016-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1444-2082-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-2272-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1708-3653-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1784-5140-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1784-5133-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1904-5231-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1904-5350-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1932-0-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1932-32-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1932-28-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1932-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1948-1917-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2004-1158-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2016-1302-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2020-4890-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2104-4252-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-2298-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2276-3099-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2412-84-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2412-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2440-2223-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2480-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2480-2812-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-4881-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2528-4998-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2532-1160-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2720-2080-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2732-5071-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2736-975-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2736-1914-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2804-3510-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-3507-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3012-2919-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3172-2647-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3320-2638-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3392-4738-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3400-2509-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3460-1808-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3484-2911-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3532-764-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3532-1908-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3536-3161-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3536-3010-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3632-2441-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3632-2289-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3648-3185-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3692-1633-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3840-88-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3840-763-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3872-2743-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3956-3175-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3972-1631-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4256-1632-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4280-4484-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4292-1807-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4312-1159-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4400-1907-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4400-2064-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4412-1436-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4424-1809-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4520-1291-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4556-2015-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-2834-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4632-2983-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4636-2560-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4636-2557-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4668-2313-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4668-2310-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-2014-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4748-5062-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-1918-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4864-2102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-2113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4876-2093-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4904-3915-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4904-4024-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4912-3449-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4912-3548-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4960-2122-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4968-1435-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5016-2475-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-4748-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5024-4860-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5028-1906-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5048-2843-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-2613-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5080-2464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-73-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-31-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download