pony | 22c2b0269eca8bee5aaa34b9bf8f227078921203798dc6fa8f5309116d2f0e59

Analysis

max time kernel
103s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
Size

2.2MB
MD5

cc05c68fbba3cb2337ee135be3a31a19
SHA1

ae958e154ca994cf79ecd110c2788903c5d63872
SHA256

22c2b0269eca8bee5aaa34b9bf8f227078921203798dc6fa8f5309116d2f0e59
SHA512

349fa3a35b650669a8b6bdb9972bcf507e2e3f9185f5d0e68c3b0f83b33bc3c5758f4fdccc20b0d8a70af024bce0a61ee3408f28a8596798d46f9859940ae2ff
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWwwJ

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe

Executes dropped EXE 58 IoCs

pid	Process
2512	explorer.exe
3504	explorer.exe
4988	spoolsv.exe
2324	spoolsv.exe
2260	spoolsv.exe
4500	spoolsv.exe
840	spoolsv.exe
4436	spoolsv.exe
4392	spoolsv.exe
764	spoolsv.exe
216	spoolsv.exe
3256	spoolsv.exe
1808	spoolsv.exe
3752	spoolsv.exe
3920	spoolsv.exe
3064	spoolsv.exe
1436	spoolsv.exe
320	spoolsv.exe
1564	spoolsv.exe
212	spoolsv.exe
3904	spoolsv.exe
3448	spoolsv.exe
1664	spoolsv.exe
3044	spoolsv.exe
1852	spoolsv.exe
5208	spoolsv.exe
5268	spoolsv.exe
5328	explorer.exe
5412	spoolsv.exe
5616	spoolsv.exe
5808	spoolsv.exe
5848	explorer.exe
1656	spoolsv.exe
5132	spoolsv.exe
5516	spoolsv.exe
5568	explorer.exe
5836	spoolsv.exe
5972	spoolsv.exe
1156	spoolsv.exe
5508	spoolsv.exe
2236	explorer.exe
5824	spoolsv.exe
1696	spoolsv.exe
5228	explorer.exe
1944	spoolsv.exe
6044	spoolsv.exe
5512	explorer.exe
5064	spoolsv.exe
3432	spoolsv.exe
6136	spoolsv.exe
4880	spoolsv.exe
3864	explorer.exe
5536	spoolsv.exe
2264	spoolsv.exe
6040	explorer.exe
4300	spoolsv.exe
3540	spoolsv.exe
5688	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 3940	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	104
PID 2512 set thread context of 3504	2512	explorer.exe	109
PID 4988 set thread context of 5268	4988	spoolsv.exe	135
PID 2324 set thread context of 5412	2324	spoolsv.exe	137
PID 2260 set thread context of 5808	2260	spoolsv.exe	139
PID 4500 set thread context of 5132	4500	spoolsv.exe	142
PID 840 set thread context of 5516	840	spoolsv.exe	143
PID 4436 set thread context of 5972	4436	spoolsv.exe	146
PID 4392 set thread context of 5508	4392	spoolsv.exe	148
PID 764 set thread context of 1696	764	spoolsv.exe	151
PID 216 set thread context of 6044	216	spoolsv.exe	154
PID 3256 set thread context of 3432	3256	spoolsv.exe	157
PID 1808 set thread context of 4880	1808	spoolsv.exe	159
PID 3752 set thread context of 2264	3752	spoolsv.exe	162
PID 3920 set thread context of 3540	3920	spoolsv.exe	166

Drops file in Windows directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3940	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
3940	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
3940	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
3940	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
3504	explorer.exe
5268	spoolsv.exe
5268	spoolsv.exe
5412	spoolsv.exe
5412	spoolsv.exe
5808	spoolsv.exe
5808	spoolsv.exe
5132	spoolsv.exe
5132	spoolsv.exe
5516	spoolsv.exe
5516	spoolsv.exe
5972	spoolsv.exe
5972	spoolsv.exe
5508	spoolsv.exe
5508	spoolsv.exe
1696	spoolsv.exe
1696	spoolsv.exe
6044	spoolsv.exe
6044	spoolsv.exe
3432	spoolsv.exe
3432	spoolsv.exe
4880	spoolsv.exe
4880	spoolsv.exe
2264	spoolsv.exe
2264	spoolsv.exe
3540	spoolsv.exe
3540	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 244	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	91
PID 2032 wrote to memory of 244	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	91
PID 2032 wrote to memory of 3940	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	104
PID 2032 wrote to memory of 3940	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	104
PID 2032 wrote to memory of 3940	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	104
PID 2032 wrote to memory of 3940	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	104
PID 2032 wrote to memory of 3940	2032	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	104
PID 3940 wrote to memory of 2512	3940	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	105
PID 3940 wrote to memory of 2512	3940	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	105
PID 3940 wrote to memory of 2512	3940	cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe	105
PID 2512 wrote to memory of 3504	2512	explorer.exe	109
PID 2512 wrote to memory of 3504	2512	explorer.exe	109
PID 2512 wrote to memory of 3504	2512	explorer.exe	109
PID 2512 wrote to memory of 3504	2512	explorer.exe	109
PID 2512 wrote to memory of 3504	2512	explorer.exe	109
PID 3504 wrote to memory of 4988	3504	explorer.exe	110
PID 3504 wrote to memory of 4988	3504	explorer.exe	110
PID 3504 wrote to memory of 4988	3504	explorer.exe	110
PID 3504 wrote to memory of 2324	3504	explorer.exe	111
PID 3504 wrote to memory of 2324	3504	explorer.exe	111
PID 3504 wrote to memory of 2324	3504	explorer.exe	111
PID 3504 wrote to memory of 2260	3504	explorer.exe	112
PID 3504 wrote to memory of 2260	3504	explorer.exe	112
PID 3504 wrote to memory of 2260	3504	explorer.exe	112
PID 3504 wrote to memory of 4500	3504	explorer.exe	113
PID 3504 wrote to memory of 4500	3504	explorer.exe	113
PID 3504 wrote to memory of 4500	3504	explorer.exe	113
PID 3504 wrote to memory of 840	3504	explorer.exe	114
PID 3504 wrote to memory of 840	3504	explorer.exe	114
PID 3504 wrote to memory of 840	3504	explorer.exe	114
PID 3504 wrote to memory of 4436	3504	explorer.exe	115
PID 3504 wrote to memory of 4436	3504	explorer.exe	115
PID 3504 wrote to memory of 4436	3504	explorer.exe	115
PID 3504 wrote to memory of 4392	3504	explorer.exe	116
PID 3504 wrote to memory of 4392	3504	explorer.exe	116
PID 3504 wrote to memory of 4392	3504	explorer.exe	116
PID 3504 wrote to memory of 764	3504	explorer.exe	118
PID 3504 wrote to memory of 764	3504	explorer.exe	118
PID 3504 wrote to memory of 764	3504	explorer.exe	118
PID 3504 wrote to memory of 216	3504	explorer.exe	119
PID 3504 wrote to memory of 216	3504	explorer.exe	119
PID 3504 wrote to memory of 216	3504	explorer.exe	119
PID 3504 wrote to memory of 3256	3504	explorer.exe	120
PID 3504 wrote to memory of 3256	3504	explorer.exe	120
PID 3504 wrote to memory of 3256	3504	explorer.exe	120
PID 3504 wrote to memory of 1808	3504	explorer.exe	121
PID 3504 wrote to memory of 1808	3504	explorer.exe	121
PID 3504 wrote to memory of 1808	3504	explorer.exe	121
PID 3504 wrote to memory of 3752	3504	explorer.exe	122
PID 3504 wrote to memory of 3752	3504	explorer.exe	122
PID 3504 wrote to memory of 3752	3504	explorer.exe	122
PID 3504 wrote to memory of 3920	3504	explorer.exe	123
PID 3504 wrote to memory of 3920	3504	explorer.exe	123
PID 3504 wrote to memory of 3920	3504	explorer.exe	123
PID 3504 wrote to memory of 3064	3504	explorer.exe	124
PID 3504 wrote to memory of 3064	3504	explorer.exe	124
PID 3504 wrote to memory of 3064	3504	explorer.exe	124
PID 3504 wrote to memory of 1436	3504	explorer.exe	125
PID 3504 wrote to memory of 1436	3504	explorer.exe	125
PID 3504 wrote to memory of 1436	3504	explorer.exe	125
PID 3504 wrote to memory of 320	3504	explorer.exe	126
PID 3504 wrote to memory of 320	3504	explorer.exe	126
PID 3504 wrote to memory of 320	3504	explorer.exe	126
PID 3504 wrote to memory of 1564	3504	explorer.exe	127

C:\Users\Admin\AppData\Local\Temp\cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:244
- C:\Users\Admin\AppData\Local\Temp\cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\cc05c68fbba3cb2337ee135be3a31a19_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3940
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5268
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5808
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5116
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:840
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5516
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4392
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5508
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2236
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5496
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:764
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1696
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:216
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6044
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3256
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3920
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5692
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2228
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:744
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2668
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3608
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:212
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:396
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3904
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3492
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:6036
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1380
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1852
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5932
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4676
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5208
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5856
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5812
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2800
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5836
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1944
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1624
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5604
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4584
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5092
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4300
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5976
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5124
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6088
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5156
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:6020
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5572
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3640
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1496
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5900
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1280
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3456
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5296
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2288
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5432
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2696
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3036
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5380
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2680
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3176
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5988
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2824
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3804,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
874a7cd7fea9c2baca30b97d58046b8a

SHA1
b6656356fc4abb75241484d70873db45aa818f8b

SHA256
91e39b604d7d332fe7858e68c50dd6dfb87b4217775f80d4987926a46fe1f838

SHA512
66346e90cd239ac72e2513dbe7c71a208574980a59ba5844c1e26336a5fe2c7be5166ca7dc9e9aabd17de841f41c4991c06642f307428a55b4db3a014271b7f7

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
0273855d289f77c4b9d399524690ab3b

SHA1
3b2a8b31cbd3d47f270b814207eacd3dce387ef2

SHA256
0c7aa3ffe2e4ead0a12b55485b6fb01c17eb93c10ac1936232edc3eed74eb13a

SHA512
09183adb8cd9a70bd8240c1b1da596e49061569eb6e403a548cddd74c7f0510f800c2a79f8a3328adce6e3d9032f7e3797860c1f02eb2090c7456afc2e7e7702

Download Submit
memory/212-1701-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/216-1086-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/320-1533-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/376-4258-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-3239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/744-4671-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/764-1035-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/840-860-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1076-2832-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1436-1527-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1564-1617-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1696-2269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1808-1270-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2032-17-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2032-0-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/2032-11-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2032-12-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/2260-1624-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2260-721-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2264-2697-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-2817-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2272-4473-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-1540-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2324-671-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2512-71-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2512-65-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2628-4460-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2628-4464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-3169-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2668-3292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2696-5464-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2696-5606-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2800-4336-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2800-4113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-5882-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-5772-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3064-1386-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3256-1147-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3480-3592-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3480-3597-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3492-3495-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3492-3372-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3504-70-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3504-470-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3540-2898-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3540-2824-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3640-4819-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3752-1322-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3904-1775-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3920-1369-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3940-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3940-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3940-57-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3940-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-978-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4436-906-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4480-4131-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4480-4133-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4492-4243-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4500-789-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4500-1708-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4672-4125-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4692-3852-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4692-3833-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4820-5061-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4880-2691-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4880-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4928-4355-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4964-4223-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4972-3084-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4988-1530-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4988-540-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5092-4383-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5116-3971-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5132-1710-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5132-1706-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5140-3879-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5152-4972-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5156-4791-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5264-3644-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5268-1600-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5268-1529-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5412-1542-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5428-4812-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5432-5416-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5480-4454-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5496-4237-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5508-1997-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5508-2134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5516-1901-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5572-4804-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5604-4527-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5640-3472-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5692-2995-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5692-3151-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5728-5053-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5768-5543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5808-1623-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5808-1763-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5856-4089-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5856-3957-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5900-5149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5900-5041-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5932-3740-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5932-3875-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5972-1869-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5972-1872-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5976-4719-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5976-4590-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6044-2302-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6044-2457-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download