pony | 3db401b484a281ebea902be30933934e736d97ce374de42aa19c78fd5a2ecca0

Analysis

max time kernel
149s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
Size

2.2MB
MD5

b6eedc84b3453d37c28a22157cbece4b
SHA1

8605358f1164788190088ef1e770c4002d3a6522
SHA256

3db401b484a281ebea902be30933934e736d97ce374de42aa19c78fd5a2ecca0
SHA512

bf49f74de6d842f595228db9d1881f321dddcf4dbec78fedbbd737708672c1920151cfb507eb143aba8cf0923adf533cae5a1bad4ec1817bf2f591470267d322
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ4:0UzeyQMS4DqodCnoe+iitjWww8

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2328	explorer.exe
2136	explorer.exe
4296	spoolsv.exe
4348	spoolsv.exe
4396	spoolsv.exe
744	spoolsv.exe
3556	spoolsv.exe
840	spoolsv.exe
3960	spoolsv.exe
4256	spoolsv.exe
2304	spoolsv.exe
2468	spoolsv.exe
908	spoolsv.exe
5104	spoolsv.exe
1496	spoolsv.exe
452	spoolsv.exe
5080	spoolsv.exe
4640	spoolsv.exe
3740	spoolsv.exe
4528	spoolsv.exe
560	spoolsv.exe
5012	spoolsv.exe
2656	spoolsv.exe
3920	spoolsv.exe
2120	spoolsv.exe
664	spoolsv.exe
2128	spoolsv.exe
3484	spoolsv.exe
4424	spoolsv.exe
2868	spoolsv.exe
4668	spoolsv.exe
2444	spoolsv.exe
2668	spoolsv.exe
1196	spoolsv.exe
964	spoolsv.exe
2512	spoolsv.exe
2720	spoolsv.exe
2688	spoolsv.exe
552	explorer.exe
1184	spoolsv.exe
3268	spoolsv.exe
3756	spoolsv.exe
1928	spoolsv.exe
3956	spoolsv.exe
4252	spoolsv.exe
3364	spoolsv.exe
996	explorer.exe
4712	spoolsv.exe
2660	spoolsv.exe
1528	spoolsv.exe
4140	spoolsv.exe
980	spoolsv.exe
3652	explorer.exe
4324	spoolsv.exe
4992	spoolsv.exe
884	spoolsv.exe
3360	spoolsv.exe
436	spoolsv.exe
2552	spoolsv.exe
4688	spoolsv.exe
2952	spoolsv.exe
1384	spoolsv.exe
4720	spoolsv.exe
1584	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 54 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 4516	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	86
PID 2328 set thread context of 2136	2328	explorer.exe	95
PID 4296 set thread context of 2688	4296	spoolsv.exe	131
PID 4348 set thread context of 1184	4348	spoolsv.exe	133
PID 4396 set thread context of 3268	4396	spoolsv.exe	134
PID 744 set thread context of 3756	744	spoolsv.exe	135
PID 3556 set thread context of 1928	3556	spoolsv.exe	136
PID 840 set thread context of 3956	840	spoolsv.exe	137
PID 3960 set thread context of 3364	3960	spoolsv.exe	139
PID 4256 set thread context of 4712	4256	spoolsv.exe	141
PID 2304 set thread context of 2660	2304	spoolsv.exe	142
PID 2468 set thread context of 4140	2468	spoolsv.exe	144
PID 908 set thread context of 980	908	spoolsv.exe	145
PID 5104 set thread context of 4324	5104	spoolsv.exe	147
PID 1496 set thread context of 4992	1496	spoolsv.exe	148
PID 452 set thread context of 884	452	spoolsv.exe	149
PID 5080 set thread context of 436	5080	spoolsv.exe	151
PID 4640 set thread context of 2552	4640	spoolsv.exe	152
PID 3740 set thread context of 4688	3740	spoolsv.exe	153
PID 4528 set thread context of 2952	4528	spoolsv.exe	154
PID 560 set thread context of 1384	560	spoolsv.exe	155
PID 5012 set thread context of 4720	5012	spoolsv.exe	156
PID 2656 set thread context of 1584	2656	spoolsv.exe	157
PID 3920 set thread context of 4352	3920	spoolsv.exe	158
PID 2120 set thread context of 1016	2120	spoolsv.exe	159
PID 664 set thread context of 752	664	spoolsv.exe	160
PID 2128 set thread context of 3864	2128	spoolsv.exe	162
PID 4424 set thread context of 4980	4424	spoolsv.exe	163
PID 3484 set thread context of 2168	3484	spoolsv.exe	164
PID 2868 set thread context of 3464	2868	spoolsv.exe	165
PID 4668 set thread context of 1120	4668	spoolsv.exe	166
PID 2444 set thread context of 4320	2444	spoolsv.exe	167
PID 2668 set thread context of 4488	2668	spoolsv.exe	168
PID 1196 set thread context of 3112	1196	spoolsv.exe	169
PID 964 set thread context of 1620	964	spoolsv.exe	170
PID 2512 set thread context of 1428	2512	spoolsv.exe	172
PID 2720 set thread context of 5064	2720	spoolsv.exe	176
PID 552 set thread context of 2756	552	explorer.exe	178
PID 4252 set thread context of 3564	4252	spoolsv.exe	180
PID 996 set thread context of 4328	996	explorer.exe	183
PID 1528 set thread context of 3180	1528	spoolsv.exe	188
PID 3652 set thread context of 4176	3652	explorer.exe	199
PID 3360 set thread context of 4344	3360	spoolsv.exe	201
PID 4056 set thread context of 3188	4056	explorer.exe	203
PID 1364 set thread context of 1604	1364	spoolsv.exe	204
PID 4732 set thread context of 4608	4732	spoolsv.exe	206
PID 1536 set thread context of 3460	1536	spoolsv.exe	208
PID 3032 set thread context of 632	3032	spoolsv.exe	210
PID 4196 set thread context of 3632	4196	explorer.exe	213
PID 4836 set thread context of 4876	4836	spoolsv.exe	215
PID 4060 set thread context of 3712	4060	explorer.exe	217
PID 4228 set thread context of 1720	4228	spoolsv.exe	219
PID 4704 set thread context of 4664	4704	spoolsv.exe	220
PID 1572 set thread context of 4484	1572	spoolsv.exe	221

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4516	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
4516	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4516	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
4516	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2136	explorer.exe
2688	spoolsv.exe
2688	spoolsv.exe
1184	spoolsv.exe
1184	spoolsv.exe
3268	spoolsv.exe
3268	spoolsv.exe
3756	spoolsv.exe
3756	spoolsv.exe
1928	spoolsv.exe
1928	spoolsv.exe
3956	spoolsv.exe
3956	spoolsv.exe
3364	spoolsv.exe
3364	spoolsv.exe
4712	spoolsv.exe
4712	spoolsv.exe
2660	spoolsv.exe
2660	spoolsv.exe
4140	spoolsv.exe
4140	spoolsv.exe
980	spoolsv.exe
980	spoolsv.exe
4324	spoolsv.exe
4324	spoolsv.exe
4992	spoolsv.exe
4992	spoolsv.exe
884	spoolsv.exe
884	spoolsv.exe
436	spoolsv.exe
436	spoolsv.exe
2552	spoolsv.exe
2552	spoolsv.exe
4688	spoolsv.exe
4688	spoolsv.exe
2952	spoolsv.exe
2952	spoolsv.exe
1384	spoolsv.exe
1384	spoolsv.exe
4720	spoolsv.exe
4720	spoolsv.exe
1584	spoolsv.exe
1584	spoolsv.exe
4352	spoolsv.exe
4352	spoolsv.exe
1016	spoolsv.exe
1016	spoolsv.exe
752	spoolsv.exe
752	spoolsv.exe
3864	spoolsv.exe
3864	spoolsv.exe
4980	spoolsv.exe
4980	spoolsv.exe
2168	spoolsv.exe
2168	spoolsv.exe
3464	spoolsv.exe
3464	spoolsv.exe
1120	spoolsv.exe
1120	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1116	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	81
PID 5104 wrote to memory of 1116	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	81
PID 5104 wrote to memory of 4516	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	86
PID 5104 wrote to memory of 4516	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	86
PID 5104 wrote to memory of 4516	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	86
PID 5104 wrote to memory of 4516	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	86
PID 5104 wrote to memory of 4516	5104	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	86
PID 4516 wrote to memory of 2328	4516	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	87
PID 4516 wrote to memory of 2328	4516	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	87
PID 4516 wrote to memory of 2328	4516	b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe	87
PID 2328 wrote to memory of 2136	2328	explorer.exe	95
PID 2328 wrote to memory of 2136	2328	explorer.exe	95
PID 2328 wrote to memory of 2136	2328	explorer.exe	95
PID 2328 wrote to memory of 2136	2328	explorer.exe	95
PID 2328 wrote to memory of 2136	2328	explorer.exe	95
PID 2136 wrote to memory of 4296	2136	explorer.exe	96
PID 2136 wrote to memory of 4296	2136	explorer.exe	96
PID 2136 wrote to memory of 4296	2136	explorer.exe	96
PID 2136 wrote to memory of 4348	2136	explorer.exe	97
PID 2136 wrote to memory of 4348	2136	explorer.exe	97
PID 2136 wrote to memory of 4348	2136	explorer.exe	97
PID 2136 wrote to memory of 4396	2136	explorer.exe	98
PID 2136 wrote to memory of 4396	2136	explorer.exe	98
PID 2136 wrote to memory of 4396	2136	explorer.exe	98
PID 2136 wrote to memory of 744	2136	explorer.exe	99
PID 2136 wrote to memory of 744	2136	explorer.exe	99
PID 2136 wrote to memory of 744	2136	explorer.exe	99
PID 2136 wrote to memory of 3556	2136	explorer.exe	100
PID 2136 wrote to memory of 3556	2136	explorer.exe	100
PID 2136 wrote to memory of 3556	2136	explorer.exe	100
PID 2136 wrote to memory of 840	2136	explorer.exe	101
PID 2136 wrote to memory of 840	2136	explorer.exe	101
PID 2136 wrote to memory of 840	2136	explorer.exe	101
PID 2136 wrote to memory of 3960	2136	explorer.exe	102
PID 2136 wrote to memory of 3960	2136	explorer.exe	102
PID 2136 wrote to memory of 3960	2136	explorer.exe	102
PID 2136 wrote to memory of 4256	2136	explorer.exe	103
PID 2136 wrote to memory of 4256	2136	explorer.exe	103
PID 2136 wrote to memory of 4256	2136	explorer.exe	103
PID 2136 wrote to memory of 2304	2136	explorer.exe	104
PID 2136 wrote to memory of 2304	2136	explorer.exe	104
PID 2136 wrote to memory of 2304	2136	explorer.exe	104
PID 2136 wrote to memory of 2468	2136	explorer.exe	105
PID 2136 wrote to memory of 2468	2136	explorer.exe	105
PID 2136 wrote to memory of 2468	2136	explorer.exe	105
PID 2136 wrote to memory of 908	2136	explorer.exe	106
PID 2136 wrote to memory of 908	2136	explorer.exe	106
PID 2136 wrote to memory of 908	2136	explorer.exe	106
PID 2136 wrote to memory of 5104	2136	explorer.exe	107
PID 2136 wrote to memory of 5104	2136	explorer.exe	107
PID 2136 wrote to memory of 5104	2136	explorer.exe	107
PID 2136 wrote to memory of 1496	2136	explorer.exe	108
PID 2136 wrote to memory of 1496	2136	explorer.exe	108
PID 2136 wrote to memory of 1496	2136	explorer.exe	108
PID 2136 wrote to memory of 452	2136	explorer.exe	109
PID 2136 wrote to memory of 452	2136	explorer.exe	109
PID 2136 wrote to memory of 452	2136	explorer.exe	109
PID 2136 wrote to memory of 5080	2136	explorer.exe	110
PID 2136 wrote to memory of 5080	2136	explorer.exe	110
PID 2136 wrote to memory of 5080	2136	explorer.exe	110
PID 2136 wrote to memory of 4640	2136	explorer.exe	111
PID 2136 wrote to memory of 4640	2136	explorer.exe	111
PID 2136 wrote to memory of 4640	2136	explorer.exe	111
PID 2136 wrote to memory of 3740	2136	explorer.exe	112

C:\Users\Admin\AppData\Local\Temp\b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1116
- C:\Users\Admin\AppData\Local\Temp\b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b6eedc84b3453d37c28a22157cbece4b_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4516
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:552
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3556
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:996
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2304
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:908
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:980
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3652
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:452
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:884
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5080
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:560
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:5012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4352
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4056
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3188
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1016
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2668
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4488
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:964
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2512
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2720
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5064
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4196
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4252
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3564
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4060
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3712
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3360
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4344
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:2408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4608
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3460
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:3032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:632
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4876
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1720
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4704
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1572
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4484
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1344
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1924
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1108
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1212
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
a278892ddeed36cab14300a149915d2a

SHA1
b96c61105e5d6a4aab43f6b5b8f4a8f6d0fa238c

SHA256
319eef0667d7ac3b2022dff69cfc23e0b0d6da4b184c43ca42cb3359cd8f5bbb

SHA512
0a5321022c7371867fe14ef1e85ca9f22b8aad5d9b3589e4ea490fdb8a26eb1d2ee05c83d7afe194169526460f5bb4408fc7ed58556f87a45a7ada2bcab5f36a

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
1abba54b7a090ef2624d196c8aed3ba9

SHA1
a595b5b93bbb8dbaf776c394060d22af0d453ae2

SHA256
b61d6491cb0f39255538526e14960f88e90cacd7c430d07af562a764acf21475

SHA512
d46b5ea066b9238758af8ae865aa9ea06b2fd36a2d736efa070426d3450e95b76a702cc56e3b68e54eee4a810c1fe90721584738b9fe938634ad9785bdb48390

Download Submit
memory/436-2664-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/452-1983-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/560-2055-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/632-5061-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/632-4807-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/664-2194-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/744-1074-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/752-2769-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/840-1481-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/908-1852-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/980-2539-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/980-2736-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1016-2755-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1120-2805-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1184-2208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1384-2722-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1428-3007-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1496-1982-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1584-2737-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1604-4493-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1620-2918-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1928-2239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2120-2059-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2128-2195-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2136-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2136-860-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2304-1793-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2328-96-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2328-90-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2468-1851-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2656-2057-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2660-2399-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-2199-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-2349-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2756-3292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2868-2198-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2952-2705-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3112-2835-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-3738-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-3840-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3188-4486-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3268-2216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3364-2376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3364-2520-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3484-2196-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3556-1480-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3564-3415-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3564-3516-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3632-4898-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3712-5139-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3740-2053-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3756-2230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3864-2771-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3920-2058-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3956-2249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3960-1482-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4140-2480-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4176-4376-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4256-1792-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4296-2189-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4296-861-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4320-2817-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4328-3476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4328-3478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4344-4478-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4344-4643-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4348-1072-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4348-2204-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4352-2754-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4396-1073-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4424-2197-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4488-2823-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4516-41-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4516-84-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4516-39-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4528-2054-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4608-4662-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4640-2052-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4668-2207-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4688-2690-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4712-2386-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4720-2723-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4876-5088-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4992-2562-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5012-2056-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5080-1984-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5104-1853-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5104-0-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/5104-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5104-38-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/5104-36-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download