pony | 82826d43d0a8b85e946c301e6a44e341e5492a037f6ad451f129552ef993f801

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
Size

2.2MB
MD5

b180270ea02a2bf7d348de6c8467d242
SHA1

0563732c64f1f11403bc5ffe1d98872c5b4ac276
SHA256

82826d43d0a8b85e946c301e6a44e341e5492a037f6ad451f129552ef993f801
SHA512

d5e120df37439d9f7bf5cea3a9af93743020d59f6f749a53e795ff9a8cddc116ac949af0ade68d542fd6c9bf944157b102791d742ad536d6240a1df8ec4dc8f2
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZo:0UzeyQMS4DqodCnoe+iitjWwwM

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2536	explorer.exe
1324	explorer.exe
2024	spoolsv.exe
1088	spoolsv.exe
2072	spoolsv.exe
1040	spoolsv.exe
3064	spoolsv.exe
2300	spoolsv.exe
2592	spoolsv.exe
2480	spoolsv.exe
1864	spoolsv.exe
2768	spoolsv.exe
1080	spoolsv.exe
1980	spoolsv.exe
2136	spoolsv.exe
2956	spoolsv.exe
2584	spoolsv.exe
1076	spoolsv.exe
1360	spoolsv.exe
2244	spoolsv.exe
964	spoolsv.exe
1536	spoolsv.exe
2884	spoolsv.exe
2016	spoolsv.exe
1948	spoolsv.exe
1684	spoolsv.exe
428	spoolsv.exe
888	spoolsv.exe
2292	spoolsv.exe
2712	spoolsv.exe
2512	spoolsv.exe
1164	spoolsv.exe
1936	spoolsv.exe
364	spoolsv.exe
2396	spoolsv.exe
2392	spoolsv.exe
2144	spoolsv.exe
968	spoolsv.exe
2176	spoolsv.exe
3068	spoolsv.exe
2496	spoolsv.exe
2012	spoolsv.exe
1768	spoolsv.exe
1572	spoolsv.exe
684	spoolsv.exe
1868	spoolsv.exe
1732	spoolsv.exe
2128	spoolsv.exe
2272	explorer.exe
2116	spoolsv.exe
1908	spoolsv.exe
1476	spoolsv.exe
856	spoolsv.exe
2748	spoolsv.exe
660	spoolsv.exe
2456	spoolsv.exe
2904	explorer.exe
2864	spoolsv.exe
2156	spoolsv.exe
2812	spoolsv.exe
572	spoolsv.exe
820	spoolsv.exe
1944	spoolsv.exe
624	explorer.exe

Loads dropped DLL 64 IoCs

pid	Process
2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 46 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 2672	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	29
PID 2536 set thread context of 1324	2536	explorer.exe	33
PID 2024 set thread context of 2128	2024	spoolsv.exe	79
PID 1088 set thread context of 2116	1088	spoolsv.exe	81
PID 2072 set thread context of 1908	2072	spoolsv.exe	82
PID 1040 set thread context of 1476	1040	spoolsv.exe	83
PID 3064 set thread context of 856	3064	spoolsv.exe	84
PID 2300 set thread context of 660	2300	spoolsv.exe	86
PID 2592 set thread context of 2456	2592	spoolsv.exe	87
PID 2480 set thread context of 2864	2480	spoolsv.exe	89
PID 1864 set thread context of 2812	1864	spoolsv.exe	91
PID 2768 set thread context of 572	2768	spoolsv.exe	92
PID 1080 set thread context of 820	1080	spoolsv.exe	93
PID 1980 set thread context of 1300	1980	spoolsv.exe	94
PID 1868 set thread context of 1912	1868	spoolsv.exe	96
PID 2136 set thread context of 520	2136	spoolsv.exe	97
PID 2956 set thread context of 2380	2956	spoolsv.exe	98
PID 964 set thread context of 800	964	spoolsv.exe	99
PID 1076 set thread context of 1640	1076	spoolsv.exe	101
PID 2584 set thread context of 2476	2584	spoolsv.exe	102
PID 2244 set thread context of 1220	2244	spoolsv.exe	103
PID 2016 set thread context of 552	2016	spoolsv.exe	105
PID 1360 set thread context of 1520	1360	spoolsv.exe	104
PID 428 set thread context of 1332	428	spoolsv.exe	106
PID 1684 set thread context of 924	1684	spoolsv.exe	108
PID 2884 set thread context of 2008	2884	spoolsv.exe	107
PID 1536 set thread context of 1060	1536	spoolsv.exe	109
PID 2712 set thread context of 1692	2712	spoolsv.exe	110
PID 888 set thread context of 2132	888	spoolsv.exe	111
PID 1164 set thread context of 1924	1164	spoolsv.exe	115
PID 364 set thread context of 2580	364	spoolsv.exe	112
PID 2392 set thread context of 2256	2392	spoolsv.exe	118
PID 2292 set thread context of 3048	2292	spoolsv.exe	113
PID 1572 set thread context of 2744	1572	spoolsv.exe	119
PID 1948 set thread context of 1180	1948	spoolsv.exe	114
PID 2396 set thread context of 2108	2396	spoolsv.exe	116
PID 2144 set thread context of 2404	2144	spoolsv.exe	120
PID 2512 set thread context of 1740	2512	spoolsv.exe	117
PID 1936 set thread context of 1644	1936	spoolsv.exe	121
PID 2496 set thread context of 1668	2496	spoolsv.exe	122
PID 2176 set thread context of 1724	2176	spoolsv.exe	123
PID 684 set thread context of 3000	684	spoolsv.exe	124
PID 2012 set thread context of 2124	2012	spoolsv.exe	126
PID 968 set thread context of 3096	968	spoolsv.exe	127
PID 3068 set thread context of 3120	3068	spoolsv.exe	128
PID 1768 set thread context of 1712	1768	spoolsv.exe	125

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
1324	explorer.exe
2128	spoolsv.exe
2128	spoolsv.exe
2116	spoolsv.exe
2116	spoolsv.exe
1908	spoolsv.exe
1908	spoolsv.exe
1476	spoolsv.exe
1476	spoolsv.exe
856	spoolsv.exe
856	spoolsv.exe
660	spoolsv.exe
660	spoolsv.exe
2456	spoolsv.exe
2456	spoolsv.exe
2864	spoolsv.exe
2864	spoolsv.exe
2812	spoolsv.exe
2812	spoolsv.exe
572	spoolsv.exe
572	spoolsv.exe
820	spoolsv.exe
820	spoolsv.exe
1300	spoolsv.exe
1300	spoolsv.exe
1912	spoolsv.exe
1912	spoolsv.exe
520	spoolsv.exe
520	spoolsv.exe
2380	spoolsv.exe
2380	spoolsv.exe
800	spoolsv.exe
800	spoolsv.exe
1640	spoolsv.exe
1640	spoolsv.exe
2476	spoolsv.exe
2476	spoolsv.exe
1220	spoolsv.exe
1220	spoolsv.exe
552	spoolsv.exe
552	spoolsv.exe
1520	spoolsv.exe
1520	spoolsv.exe
1332	spoolsv.exe
1332	spoolsv.exe
924	spoolsv.exe
924	spoolsv.exe
1060	spoolsv.exe
1060	spoolsv.exe
1692	spoolsv.exe
1692	spoolsv.exe
1924	spoolsv.exe
2008	spoolsv.exe
1924	spoolsv.exe
2580	spoolsv.exe
2580	spoolsv.exe
2132	spoolsv.exe
2008	spoolsv.exe
2132	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2732	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	28
PID 1560 wrote to memory of 2732	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	28
PID 1560 wrote to memory of 2732	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	28
PID 1560 wrote to memory of 2732	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	28
PID 1560 wrote to memory of 2672	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	29
PID 1560 wrote to memory of 2672	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	29
PID 1560 wrote to memory of 2672	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	29
PID 1560 wrote to memory of 2672	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	29
PID 1560 wrote to memory of 2672	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	29
PID 1560 wrote to memory of 2672	1560	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	29
PID 2672 wrote to memory of 2536	2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2536	2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2536	2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	30
PID 2672 wrote to memory of 2536	2672	b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe	30
PID 2536 wrote to memory of 1324	2536	explorer.exe	33
PID 2536 wrote to memory of 1324	2536	explorer.exe	33
PID 2536 wrote to memory of 1324	2536	explorer.exe	33
PID 2536 wrote to memory of 1324	2536	explorer.exe	33
PID 2536 wrote to memory of 1324	2536	explorer.exe	33
PID 2536 wrote to memory of 1324	2536	explorer.exe	33
PID 1324 wrote to memory of 2024	1324	explorer.exe	34
PID 1324 wrote to memory of 2024	1324	explorer.exe	34
PID 1324 wrote to memory of 2024	1324	explorer.exe	34
PID 1324 wrote to memory of 2024	1324	explorer.exe	34
PID 1324 wrote to memory of 1088	1324	explorer.exe	35
PID 1324 wrote to memory of 1088	1324	explorer.exe	35
PID 1324 wrote to memory of 1088	1324	explorer.exe	35
PID 1324 wrote to memory of 1088	1324	explorer.exe	35
PID 1324 wrote to memory of 2072	1324	explorer.exe	36
PID 1324 wrote to memory of 2072	1324	explorer.exe	36
PID 1324 wrote to memory of 2072	1324	explorer.exe	36
PID 1324 wrote to memory of 2072	1324	explorer.exe	36
PID 1324 wrote to memory of 1040	1324	explorer.exe	37
PID 1324 wrote to memory of 1040	1324	explorer.exe	37
PID 1324 wrote to memory of 1040	1324	explorer.exe	37
PID 1324 wrote to memory of 1040	1324	explorer.exe	37
PID 1324 wrote to memory of 3064	1324	explorer.exe	38
PID 1324 wrote to memory of 3064	1324	explorer.exe	38
PID 1324 wrote to memory of 3064	1324	explorer.exe	38
PID 1324 wrote to memory of 3064	1324	explorer.exe	38
PID 1324 wrote to memory of 2300	1324	explorer.exe	39
PID 1324 wrote to memory of 2300	1324	explorer.exe	39
PID 1324 wrote to memory of 2300	1324	explorer.exe	39
PID 1324 wrote to memory of 2300	1324	explorer.exe	39
PID 1324 wrote to memory of 2592	1324	explorer.exe	40
PID 1324 wrote to memory of 2592	1324	explorer.exe	40
PID 1324 wrote to memory of 2592	1324	explorer.exe	40
PID 1324 wrote to memory of 2592	1324	explorer.exe	40
PID 1324 wrote to memory of 2480	1324	explorer.exe	41
PID 1324 wrote to memory of 2480	1324	explorer.exe	41
PID 1324 wrote to memory of 2480	1324	explorer.exe	41
PID 1324 wrote to memory of 2480	1324	explorer.exe	41
PID 1324 wrote to memory of 1864	1324	explorer.exe	42
PID 1324 wrote to memory of 1864	1324	explorer.exe	42
PID 1324 wrote to memory of 1864	1324	explorer.exe	42
PID 1324 wrote to memory of 1864	1324	explorer.exe	42
PID 1324 wrote to memory of 2768	1324	explorer.exe	43
PID 1324 wrote to memory of 2768	1324	explorer.exe	43
PID 1324 wrote to memory of 2768	1324	explorer.exe	43
PID 1324 wrote to memory of 2768	1324	explorer.exe	43
PID 1324 wrote to memory of 1080	1324	explorer.exe	44
PID 1324 wrote to memory of 1080	1324	explorer.exe	44
PID 1324 wrote to memory of 1080	1324	explorer.exe	44
PID 1324 wrote to memory of 1080	1324	explorer.exe	44

C:\Users\Admin\AppData\Local\Temp\b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b180270ea02a2bf7d348de6c8467d242_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2024
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2072
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2592
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2480
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1864
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1300
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1076
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2244
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1180
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:888
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2292
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1164
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2256
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:968
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3068
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1768
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1732
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1196
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUD

Filesize
56KB

MD5
bd72dcf1083b6e22ccbfa0e8e27fb1e0

SHA1
3fd23d4f14da768da7b8364d74c54932d704e74e

SHA256
90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

SHA512
72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

Download Submit
\Windows\system\explorer.exe

Filesize
2.2MB

MD5
f17455b372b0aae0eb8c89e9bcc0005c

SHA1
e9417b914ae1cae43c2290232246e6246eb84fa5

SHA256
2e9ef245ec3eb5d450a8ed7f1b975b1fd8b7f25834fe10ccb56fd9a3098b18d0

SHA512
bb937f905ca1d717ef7fdec0095fcd2801e03e92349bca957da1ed0a316944200c3a27098e762b275db505f8ca80c8bef27c45c3ea5cd3c7cb88c337927d95e1

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.2MB

MD5
c3a3cdeadea6cf29daa2901449d78494

SHA1
09ba5082b3c0650cc7631cb302e87ba1edc5ce89

SHA256
f036daadb117cab41f02e4de949fa22061492a2a2352e672d69306ec7a873983

SHA512
c7a433f07a0009f31ca9792fc995553ad82be520d93696b21e968c2981c52e2b616a5549c140a4c1acbf442a7b44533649a29ffccf04a076e12e96afbcc8e79d

Download Submit
memory/428-1887-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/520-2318-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/572-2110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/660-2001-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/800-2348-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/820-2283-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/888-1888-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/964-1705-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1040-981-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1060-2502-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1076-1565-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1080-1387-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1088-760-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1180-2671-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1220-2402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1324-543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1332-2471-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1360-1703-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1476-1967-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-2445-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1536-1706-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1560-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1560-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1560-23-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1560-12-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1640-2371-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1684-1886-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1692-2518-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1864-1385-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1908-1951-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1924-2521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1948-1885-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1980-1561-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2016-1708-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2024-544-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2024-1909-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2072-980-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2116-1935-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-2688-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-2016-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-1915-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2132-2528-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2136-1562-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2244-1704-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2292-1889-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2300-1168-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2380-2333-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-2561-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2456-2047-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2456-2123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2476-2398-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2480-1384-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2536-56-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2536-37-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2536-66-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2580-2526-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2584-1564-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2592-1174-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2672-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-19-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-45-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2712-1900-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2768-1386-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2812-2099-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-2071-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2884-1707-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2956-1563-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3064-982-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3120-2689-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download