pony | b4a47ebbe1e977760df6c7c81b2ca99d27ea0702864dde4fff6d4d937d630fa5

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
Size

2.2MB
MD5

b711cca93c12e8fe3c1155abe7943b60
SHA1

db433b309bb0b64e11aae17cde1d804a60119ce7
SHA256

b4a47ebbe1e977760df6c7c81b2ca99d27ea0702864dde4fff6d4d937d630fa5
SHA512

c2d2ee75148c5bac9834ef310d0882e7b37f22c48903f40c3398d93b4688f411b3bf06242fffe77aac4267667c7e86188ec5e932307ef042bae116773831986b
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWwwt

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1944	explorer.exe
4148	explorer.exe
2568	spoolsv.exe
3792	spoolsv.exe
4236	spoolsv.exe
3196	spoolsv.exe
3996	spoolsv.exe
3356	spoolsv.exe
2052	spoolsv.exe
4544	spoolsv.exe
4468	spoolsv.exe
1892	spoolsv.exe
2428	spoolsv.exe
2004	spoolsv.exe
3408	spoolsv.exe
2796	spoolsv.exe
2168	spoolsv.exe
3884	spoolsv.exe
544	spoolsv.exe
2028	spoolsv.exe
3428	spoolsv.exe
732	spoolsv.exe
944	spoolsv.exe
4340	spoolsv.exe
4604	spoolsv.exe
2868	spoolsv.exe
4656	spoolsv.exe
4900	spoolsv.exe
2104	spoolsv.exe
3416	spoolsv.exe
3128	spoolsv.exe
2280	spoolsv.exe
64	spoolsv.exe
1956	spoolsv.exe
8	spoolsv.exe
696	spoolsv.exe
1000	spoolsv.exe
3732	spoolsv.exe
4700	spoolsv.exe
804	explorer.exe
1068	spoolsv.exe
3316	spoolsv.exe
5112	spoolsv.exe
4476	spoolsv.exe
5096	spoolsv.exe
3508	spoolsv.exe
1428	spoolsv.exe
4512	spoolsv.exe
488	spoolsv.exe
4732	explorer.exe
2792	spoolsv.exe
3576	spoolsv.exe
4524	spoolsv.exe
1600	spoolsv.exe
4308	spoolsv.exe
2524	spoolsv.exe
4904	spoolsv.exe
920	spoolsv.exe
4568	spoolsv.exe
4540	spoolsv.exe
1516	spoolsv.exe
2908	explorer.exe
4668	spoolsv.exe
468	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 53 IoCs

description	pid	Process	procid_target
PID 3620 set thread context of 1444	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	89
PID 1944 set thread context of 4148	1944	explorer.exe	94
PID 2568 set thread context of 4700	2568	spoolsv.exe	131
PID 3792 set thread context of 1068	3792	spoolsv.exe	133
PID 4236 set thread context of 3316	4236	spoolsv.exe	134
PID 3196 set thread context of 5112	3196	spoolsv.exe	135
PID 3996 set thread context of 4476	3996	spoolsv.exe	136
PID 3356 set thread context of 5096	3356	spoolsv.exe	137
PID 2052 set thread context of 1428	2052	spoolsv.exe	139
PID 4544 set thread context of 4512	4544	spoolsv.exe	140
PID 4468 set thread context of 488	4468	spoolsv.exe	141
PID 1892 set thread context of 2792	1892	spoolsv.exe	143
PID 2428 set thread context of 3576	2428	spoolsv.exe	144
PID 2004 set thread context of 4524	2004	spoolsv.exe	145
PID 3408 set thread context of 1600	3408	spoolsv.exe	146
PID 2796 set thread context of 4308	2796	spoolsv.exe	147
PID 2168 set thread context of 2524	2168	spoolsv.exe	148
PID 3884 set thread context of 920	3884	spoolsv.exe	150
PID 544 set thread context of 4568	544	spoolsv.exe	151
PID 2028 set thread context of 4540	2028	spoolsv.exe	152
PID 3428 set thread context of 1516	3428	spoolsv.exe	153
PID 732 set thread context of 4668	732	spoolsv.exe	155
PID 944 set thread context of 468	944	spoolsv.exe	156
PID 4340 set thread context of 4384	4340	spoolsv.exe	157
PID 4604 set thread context of 876	4604	spoolsv.exe	158
PID 2868 set thread context of 2864	2868	spoolsv.exe	160
PID 4656 set thread context of 4312	4656	spoolsv.exe	161
PID 4900 set thread context of 1504	4900	spoolsv.exe	162
PID 2104 set thread context of 3236	2104	spoolsv.exe	164
PID 3416 set thread context of 4676	3416	spoolsv.exe	165
PID 3128 set thread context of 3628	3128	spoolsv.exe	166
PID 2280 set thread context of 3936	2280	spoolsv.exe	167
PID 64 set thread context of 3268	64	spoolsv.exe	169
PID 1956 set thread context of 4828	1956	spoolsv.exe	170
PID 8 set thread context of 2444	8	spoolsv.exe	171
PID 696 set thread context of 2500	696	spoolsv.exe	173
PID 1000 set thread context of 5064	1000	spoolsv.exe	174
PID 3732 set thread context of 3620	3732	spoolsv.exe	179
PID 804 set thread context of 2640	804	explorer.exe	182
PID 3508 set thread context of 2924	3508	spoolsv.exe	189
PID 4732 set thread context of 4736	4732	explorer.exe	193
PID 4904 set thread context of 1044	4904	spoolsv.exe	198
PID 2908 set thread context of 3692	2908	explorer.exe	202
PID 1348 set thread context of 3180	1348	spoolsv.exe	208
PID 4504 set thread context of 4508	4504	explorer.exe	211
PID 1924 set thread context of 4536	1924	spoolsv.exe	213
PID 2544 set thread context of 3168	2544	explorer.exe	215
PID 1344 set thread context of 2096	1344	spoolsv.exe	217
PID 1928 set thread context of 2260	1928	spoolsv.exe	219
PID 2844 set thread context of 3828	2844	spoolsv.exe	221
PID 2608 set thread context of 2624	2608	spoolsv.exe	223
PID 4004 set thread context of 4052	4004	explorer.exe	225
PID 4436 set thread context of 1092	4436	spoolsv.exe	226

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1444	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
1444	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4148	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1444	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
1444	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4148	explorer.exe
4700	spoolsv.exe
4700	spoolsv.exe
1068	spoolsv.exe
1068	spoolsv.exe
3316	spoolsv.exe
3316	spoolsv.exe
5112	spoolsv.exe
5112	spoolsv.exe
4476	spoolsv.exe
4476	spoolsv.exe
5096	spoolsv.exe
5096	spoolsv.exe
1428	spoolsv.exe
1428	spoolsv.exe
4512	spoolsv.exe
4512	spoolsv.exe
488	spoolsv.exe
488	spoolsv.exe
3576	spoolsv.exe
3576	spoolsv.exe
4524	spoolsv.exe
4524	spoolsv.exe
1600	spoolsv.exe
1600	spoolsv.exe
4308	spoolsv.exe
4308	spoolsv.exe
2524	spoolsv.exe
2524	spoolsv.exe
920	spoolsv.exe
920	spoolsv.exe
4568	spoolsv.exe
4568	spoolsv.exe
4540	spoolsv.exe
4540	spoolsv.exe
1516	spoolsv.exe
1516	spoolsv.exe
4668	spoolsv.exe
4668	spoolsv.exe
468	spoolsv.exe
468	spoolsv.exe
4384	spoolsv.exe
4384	spoolsv.exe
876	spoolsv.exe
876	spoolsv.exe
2864	spoolsv.exe
2864	spoolsv.exe
4312	spoolsv.exe
4312	spoolsv.exe
1504	spoolsv.exe
1504	spoolsv.exe
3236	spoolsv.exe
3236	spoolsv.exe
4676	spoolsv.exe
4676	spoolsv.exe
3628	spoolsv.exe
3628	spoolsv.exe
3936	spoolsv.exe
3936	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 5116	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	81
PID 3620 wrote to memory of 5116	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	81
PID 3620 wrote to memory of 1444	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	89
PID 3620 wrote to memory of 1444	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	89
PID 3620 wrote to memory of 1444	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	89
PID 3620 wrote to memory of 1444	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	89
PID 3620 wrote to memory of 1444	3620	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	89
PID 1444 wrote to memory of 1944	1444	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	90
PID 1444 wrote to memory of 1944	1444	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	90
PID 1444 wrote to memory of 1944	1444	b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe	90
PID 1944 wrote to memory of 4148	1944	explorer.exe	94
PID 1944 wrote to memory of 4148	1944	explorer.exe	94
PID 1944 wrote to memory of 4148	1944	explorer.exe	94
PID 1944 wrote to memory of 4148	1944	explorer.exe	94
PID 1944 wrote to memory of 4148	1944	explorer.exe	94
PID 4148 wrote to memory of 2568	4148	explorer.exe	95
PID 4148 wrote to memory of 2568	4148	explorer.exe	95
PID 4148 wrote to memory of 2568	4148	explorer.exe	95
PID 4148 wrote to memory of 3792	4148	explorer.exe	96
PID 4148 wrote to memory of 3792	4148	explorer.exe	96
PID 4148 wrote to memory of 3792	4148	explorer.exe	96
PID 4148 wrote to memory of 4236	4148	explorer.exe	97
PID 4148 wrote to memory of 4236	4148	explorer.exe	97
PID 4148 wrote to memory of 4236	4148	explorer.exe	97
PID 4148 wrote to memory of 3196	4148	explorer.exe	98
PID 4148 wrote to memory of 3196	4148	explorer.exe	98
PID 4148 wrote to memory of 3196	4148	explorer.exe	98
PID 4148 wrote to memory of 3996	4148	explorer.exe	99
PID 4148 wrote to memory of 3996	4148	explorer.exe	99
PID 4148 wrote to memory of 3996	4148	explorer.exe	99
PID 4148 wrote to memory of 3356	4148	explorer.exe	100
PID 4148 wrote to memory of 3356	4148	explorer.exe	100
PID 4148 wrote to memory of 3356	4148	explorer.exe	100
PID 4148 wrote to memory of 2052	4148	explorer.exe	101
PID 4148 wrote to memory of 2052	4148	explorer.exe	101
PID 4148 wrote to memory of 2052	4148	explorer.exe	101
PID 4148 wrote to memory of 4544	4148	explorer.exe	102
PID 4148 wrote to memory of 4544	4148	explorer.exe	102
PID 4148 wrote to memory of 4544	4148	explorer.exe	102
PID 4148 wrote to memory of 4468	4148	explorer.exe	103
PID 4148 wrote to memory of 4468	4148	explorer.exe	103
PID 4148 wrote to memory of 4468	4148	explorer.exe	103
PID 4148 wrote to memory of 1892	4148	explorer.exe	104
PID 4148 wrote to memory of 1892	4148	explorer.exe	104
PID 4148 wrote to memory of 1892	4148	explorer.exe	104
PID 4148 wrote to memory of 2428	4148	explorer.exe	105
PID 4148 wrote to memory of 2428	4148	explorer.exe	105
PID 4148 wrote to memory of 2428	4148	explorer.exe	105
PID 4148 wrote to memory of 2004	4148	explorer.exe	106
PID 4148 wrote to memory of 2004	4148	explorer.exe	106
PID 4148 wrote to memory of 2004	4148	explorer.exe	106
PID 4148 wrote to memory of 3408	4148	explorer.exe	107
PID 4148 wrote to memory of 3408	4148	explorer.exe	107
PID 4148 wrote to memory of 3408	4148	explorer.exe	107
PID 4148 wrote to memory of 2796	4148	explorer.exe	108
PID 4148 wrote to memory of 2796	4148	explorer.exe	108
PID 4148 wrote to memory of 2796	4148	explorer.exe	108
PID 4148 wrote to memory of 2168	4148	explorer.exe	109
PID 4148 wrote to memory of 2168	4148	explorer.exe	109
PID 4148 wrote to memory of 2168	4148	explorer.exe	109
PID 4148 wrote to memory of 3884	4148	explorer.exe	110
PID 4148 wrote to memory of 3884	4148	explorer.exe	110
PID 4148 wrote to memory of 3884	4148	explorer.exe	110
PID 4148 wrote to memory of 544	4148	explorer.exe	111

C:\Users\Admin\AppData\Local\Temp\b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\Temp\b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b711cca93c12e8fe3c1155abe7943b60_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1444
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Modifies Installed Components in the registry
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:804
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3792
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3996
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3356
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:488
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4732
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1892
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2004
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3408
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:544
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1516
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2908
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4384
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4604
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2868
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4900
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4504
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2104
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3416
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3128
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2280
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:64
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3268
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:8
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2444
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2544
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:696
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3620
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4004
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4052
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3508
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2924
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1924
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4536
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:3980
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:1344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2096
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1928
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        
        PID:2844
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3828
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:4328
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2608
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1092
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1220
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3920
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1136
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:228
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5340
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5468
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3172
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:1788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1644
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4564
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
63ed4d3355dcc7b5c90c1b79d893ee2c

SHA1
063ee1e628d536786973bd671792f92b52550b79

SHA256
a9262aab766ee12e117ed98a79f3a65013bbc44746b192a8b81ecd0666aa6c32

SHA512
10856a36f1e53773ecefb6260d284595e1a780a6802171c3d0c3f8aa898eb825f1d55843ddc6c2e289540d8a81c5c080165b792615c66f31d0e0cef4227d81cc

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
b09aa6734ce65410339bf11eecda7638

SHA1
5c78e224ac64e4a1640a7d730d3efa64202f9ae0

SHA256
2f670a0474ca41ea6e9443dabf8837313e9ee4ae27643012159a8075369a330c

SHA512
31bed72f1772600ac1b958556dd2644cd99026823c37c949144c238d8391b93f5be0984848d69f32d77edeae4346ff748313535457e2f968b8ddbc68b6ce09ec

Download Submit
memory/468-2920-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/488-2641-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/488-2882-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/544-2075-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/732-2322-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/920-2784-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/944-2323-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1044-4814-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1044-4947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1068-2424-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1092-6091-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1428-2541-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-94-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-92-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1444-46-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1444-44-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1504-3328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1516-2900-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1600-2676-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1600-2680-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1892-1713-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1944-110-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1944-105-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2004-1902-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2028-2076-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2052-1475-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2096-5708-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2168-1905-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2260-5716-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2260-5720-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2428-1714-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2444-3499-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2444-3341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2524-2697-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2524-2700-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2568-1084-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2568-2415-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2640-3848-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2796-1904-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2864-3030-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2868-2413-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2924-4286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2924-4420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3168-5540-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3168-5535-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-5306-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-5414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3196-1282-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3236-3135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3236-3133-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3268-3244-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3316-2433-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3356-1474-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3408-1903-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3428-2321-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3576-2657-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-3715-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-43-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/3620-3817-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-0-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/3620-41-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3620-47-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3692-4969-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3792-2421-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3792-1280-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3828-5836-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3884-2074-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3936-3161-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3996-1473-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4052-5930-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4148-1083-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4148-109-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4236-1281-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4236-2435-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4340-2411-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4384-2928-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4428-6238-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4468-1712-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4476-2456-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4508-5503-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-2598-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4524-2667-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4536-5529-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4536-5663-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4540-2825-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4540-2806-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4544-1476-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4568-2800-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-6208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4604-2412-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4656-2423-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4668-2909-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4700-2414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4700-2620-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4736-4522-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4828-3256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5064-3402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-2464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5112-2445-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5340-6404-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download