pony | 42d0dbcf719f4acf61e567c3c99a6d8663ff8a65450c288716615775cddf37b3

Analysis

max time kernel
130s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
Size

2.2MB
MD5

cd8e824cb3994d00ad16383042addd56
SHA1

6640e9f3a4bb6c683ce65e12fbfd50b37fbb47f8
SHA256

42d0dbcf719f4acf61e567c3c99a6d8663ff8a65450c288716615775cddf37b3
SHA512

286f34f1ac486140d7782b6d31575186881b1d2f89d825d7a9a9910bdb5c164ef803bcc0bdded00335f26a922a50006b6332559f8c9b38834adaa4de6b983abe
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ/:0UzeyQMS4DqodCnoe+iitjWwwT

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
1844	explorer.exe
552	explorer.exe
4500	spoolsv.exe
1476	spoolsv.exe
2640	spoolsv.exe
1196	spoolsv.exe
1564	spoolsv.exe
2872	spoolsv.exe
4404	spoolsv.exe
4176	spoolsv.exe
4816	spoolsv.exe
2688	spoolsv.exe
1336	spoolsv.exe
2428	spoolsv.exe
1796	spoolsv.exe
1120	spoolsv.exe
4948	spoolsv.exe
4236	spoolsv.exe
4328	spoolsv.exe
976	spoolsv.exe
4240	spoolsv.exe
1444	spoolsv.exe
1388	spoolsv.exe
2664	spoolsv.exe
4956	spoolsv.exe
1740	spoolsv.exe
3860	spoolsv.exe
848	spoolsv.exe
2340	spoolsv.exe
232	spoolsv.exe
2212	explorer.exe
5068	spoolsv.exe
4304	spoolsv.exe
2328	spoolsv.exe
804	spoolsv.exe
4396	explorer.exe
4032	spoolsv.exe
3544	spoolsv.exe
4428	spoolsv.exe
1760	spoolsv.exe
1328	spoolsv.exe
5012	explorer.exe
3668	spoolsv.exe
4748	spoolsv.exe
2236	spoolsv.exe
3148	spoolsv.exe
1592	spoolsv.exe
436	spoolsv.exe
1904	spoolsv.exe
2616	spoolsv.exe
2124	spoolsv.exe
3696	explorer.exe
4036	spoolsv.exe
3916	spoolsv.exe
2716	spoolsv.exe
4856	explorer.exe
1520	spoolsv.exe
2000	spoolsv.exe
2392	spoolsv.exe
1824	spoolsv.exe
628	spoolsv.exe
1072	spoolsv.exe
4928	explorer.exe
3000	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 39 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 3112	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	96
PID 1844 set thread context of 552	1844	explorer.exe	101
PID 4500 set thread context of 232	4500	spoolsv.exe	130
PID 1476 set thread context of 5068	1476	spoolsv.exe	132
PID 2640 set thread context of 4304	2640	spoolsv.exe	133
PID 1196 set thread context of 804	1196	spoolsv.exe	135
PID 1564 set thread context of 3544	1564	spoolsv.exe	138
PID 2872 set thread context of 4428	2872	spoolsv.exe	139
PID 4404 set thread context of 1328	4404	spoolsv.exe	141
PID 4176 set thread context of 3668	4176	spoolsv.exe	143
PID 4816 set thread context of 4748	4816	spoolsv.exe	144
PID 2688 set thread context of 2236	2688	spoolsv.exe	145
PID 1336 set thread context of 3148	1336	spoolsv.exe	146
PID 2428 set thread context of 1592	2428	spoolsv.exe	147
PID 1796 set thread context of 436	1796	spoolsv.exe	148
PID 1120 set thread context of 1904	1120	spoolsv.exe	149
PID 4948 set thread context of 2124	4948	spoolsv.exe	151
PID 4236 set thread context of 4036	4236	spoolsv.exe	153
PID 4328 set thread context of 2716	4328	spoolsv.exe	156
PID 976 set thread context of 1520	976	spoolsv.exe	158
PID 4240 set thread context of 2000	4240	spoolsv.exe	159
PID 1444 set thread context of 2392	1444	spoolsv.exe	160
PID 1388 set thread context of 628	1388	spoolsv.exe	162
PID 2664 set thread context of 1072	2664	spoolsv.exe	163
PID 4956 set thread context of 3000	4956	spoolsv.exe	165
PID 1740 set thread context of 4048	1740	spoolsv.exe	166
PID 3860 set thread context of 2588	3860	spoolsv.exe	168
PID 848 set thread context of 1240	848	spoolsv.exe	169
PID 2340 set thread context of 3180	2340	spoolsv.exe	176
PID 2212 set thread context of 2676	2212	explorer.exe	178
PID 2328 set thread context of 4880	2328	spoolsv.exe	180
PID 4396 set thread context of 4060	4396	explorer.exe	183
PID 4032 set thread context of 1896	4032	spoolsv.exe	184
PID 1760 set thread context of 4752	1760	spoolsv.exe	193
PID 5012 set thread context of 4992	5012	explorer.exe	194
PID 2616 set thread context of 2792	2616	spoolsv.exe	199
PID 3696 set thread context of 3548	3696	explorer.exe	201
PID 3916 set thread context of 5844	3916	spoolsv.exe	210
PID 4856 set thread context of 5940	4856	explorer.exe	212

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3112	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
3112	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
552	explorer.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3112	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
3112	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
552	explorer.exe
232	spoolsv.exe
232	spoolsv.exe
5068	spoolsv.exe
5068	spoolsv.exe
4304	spoolsv.exe
4304	spoolsv.exe
804	spoolsv.exe
804	spoolsv.exe
3544	spoolsv.exe
3544	spoolsv.exe
4428	spoolsv.exe
4428	spoolsv.exe
1328	spoolsv.exe
1328	spoolsv.exe
3668	spoolsv.exe
3668	spoolsv.exe
4748	spoolsv.exe
4748	spoolsv.exe
2236	spoolsv.exe
2236	spoolsv.exe
3148	spoolsv.exe
3148	spoolsv.exe
1592	spoolsv.exe
1592	spoolsv.exe
436	spoolsv.exe
436	spoolsv.exe
1904	spoolsv.exe
1904	spoolsv.exe
2124	spoolsv.exe
2124	spoolsv.exe
4036	spoolsv.exe
4036	spoolsv.exe
2716	spoolsv.exe
2716	spoolsv.exe
1520	spoolsv.exe
1520	spoolsv.exe
2000	spoolsv.exe
2000	spoolsv.exe
2392	spoolsv.exe
2392	spoolsv.exe
628	spoolsv.exe
628	spoolsv.exe
1072	spoolsv.exe
1072	spoolsv.exe
3000	spoolsv.exe
3000	spoolsv.exe
4048	spoolsv.exe
4048	spoolsv.exe
2588	spoolsv.exe
2588	spoolsv.exe
1240	spoolsv.exe
1240	spoolsv.exe
3180	spoolsv.exe
3180	spoolsv.exe
2676	explorer.exe
2676	explorer.exe
4880	spoolsv.exe
4880	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4772	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	84
PID 5096 wrote to memory of 4772	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	84
PID 5096 wrote to memory of 3112	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	96
PID 5096 wrote to memory of 3112	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	96
PID 5096 wrote to memory of 3112	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	96
PID 5096 wrote to memory of 3112	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	96
PID 5096 wrote to memory of 3112	5096	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	96
PID 3112 wrote to memory of 1844	3112	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	97
PID 3112 wrote to memory of 1844	3112	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	97
PID 3112 wrote to memory of 1844	3112	cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe	97
PID 1844 wrote to memory of 552	1844	explorer.exe	101
PID 1844 wrote to memory of 552	1844	explorer.exe	101
PID 1844 wrote to memory of 552	1844	explorer.exe	101
PID 1844 wrote to memory of 552	1844	explorer.exe	101
PID 1844 wrote to memory of 552	1844	explorer.exe	101
PID 552 wrote to memory of 4500	552	explorer.exe	102
PID 552 wrote to memory of 4500	552	explorer.exe	102
PID 552 wrote to memory of 4500	552	explorer.exe	102
PID 552 wrote to memory of 1476	552	explorer.exe	103
PID 552 wrote to memory of 1476	552	explorer.exe	103
PID 552 wrote to memory of 1476	552	explorer.exe	103
PID 552 wrote to memory of 2640	552	explorer.exe	104
PID 552 wrote to memory of 2640	552	explorer.exe	104
PID 552 wrote to memory of 2640	552	explorer.exe	104
PID 552 wrote to memory of 1196	552	explorer.exe	105
PID 552 wrote to memory of 1196	552	explorer.exe	105
PID 552 wrote to memory of 1196	552	explorer.exe	105
PID 552 wrote to memory of 1564	552	explorer.exe	106
PID 552 wrote to memory of 1564	552	explorer.exe	106
PID 552 wrote to memory of 1564	552	explorer.exe	106
PID 552 wrote to memory of 2872	552	explorer.exe	107
PID 552 wrote to memory of 2872	552	explorer.exe	107
PID 552 wrote to memory of 2872	552	explorer.exe	107
PID 552 wrote to memory of 4404	552	explorer.exe	108
PID 552 wrote to memory of 4404	552	explorer.exe	108
PID 552 wrote to memory of 4404	552	explorer.exe	108
PID 552 wrote to memory of 4176	552	explorer.exe	109
PID 552 wrote to memory of 4176	552	explorer.exe	109
PID 552 wrote to memory of 4176	552	explorer.exe	109
PID 552 wrote to memory of 4816	552	explorer.exe	110
PID 552 wrote to memory of 4816	552	explorer.exe	110
PID 552 wrote to memory of 4816	552	explorer.exe	110
PID 552 wrote to memory of 2688	552	explorer.exe	111
PID 552 wrote to memory of 2688	552	explorer.exe	111
PID 552 wrote to memory of 2688	552	explorer.exe	111
PID 552 wrote to memory of 1336	552	explorer.exe	113
PID 552 wrote to memory of 1336	552	explorer.exe	113
PID 552 wrote to memory of 1336	552	explorer.exe	113
PID 552 wrote to memory of 2428	552	explorer.exe	114
PID 552 wrote to memory of 2428	552	explorer.exe	114
PID 552 wrote to memory of 2428	552	explorer.exe	114
PID 552 wrote to memory of 1796	552	explorer.exe	115
PID 552 wrote to memory of 1796	552	explorer.exe	115
PID 552 wrote to memory of 1796	552	explorer.exe	115
PID 552 wrote to memory of 1120	552	explorer.exe	116
PID 552 wrote to memory of 1120	552	explorer.exe	116
PID 552 wrote to memory of 1120	552	explorer.exe	116
PID 552 wrote to memory of 4948	552	explorer.exe	117
PID 552 wrote to memory of 4948	552	explorer.exe	117
PID 552 wrote to memory of 4948	552	explorer.exe	117
PID 552 wrote to memory of 4236	552	explorer.exe	118
PID 552 wrote to memory of 4236	552	explorer.exe	118
PID 552 wrote to memory of 4236	552	explorer.exe	118
PID 552 wrote to memory of 4328	552	explorer.exe	119

C:\Users\Admin\AppData\Local\Temp\cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\cd8e824cb3994d00ad16383042addd56_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3112
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4500
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:232
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2640
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:804
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1564
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1328
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4748
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2688
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1336
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2428
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1796
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:436
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1120
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:4948
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:3696
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4236
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4036
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5940
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4240
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1444
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1388
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2664
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1072
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:4928
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4956
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4048
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3860
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:848
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1240
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2340
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3180
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        
        PID:368
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:852
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4032
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1760
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4752
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4024
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2792
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5844
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5680
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5756
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:3260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3848
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5200
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5040
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5728
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3296
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4592
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1568
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5336
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:444
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2368
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3620
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1436
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4528
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3516
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2880
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4584
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:4932
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:2684
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Drops file in Windows directory
        
        PID:5452
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5568
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5664
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3648
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe

Filesize
2.2MB

MD5
2c53a54f8e076f54ec512284017b5960

SHA1
064c516fed2898bcaac1cbeade37326d60600f44

SHA256
1c62d54bb23329abe792b3e571735aebd8d388fe7308ed42f76a0356659af468

SHA512
eb96e05d0289d491dc56eee9fc7482cf4968110ec44ed5e0a73c9f6f48da1d0705387c379b58c1e1585132eb9408f5c24918e33b8db5f8843952f938530bab40

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
340b144f4e8ce1511911171d8e2017a0

SHA1
57c35b5bad00d061541dea83ea9606fd63186206

SHA256
a0754c95d8e67b3795d2bfadb500027f17d207a246a49a805a9d8ad5ff7b3818

SHA512
d8bb7e29bff84e4e94aa702c2ecd1d248e45ff5efb9a6def4067b6202a080027f2fc03d277d3e631c355c499ed1146e7ff32f3e92e294abfe33676fe121ca0b3

Download Submit
memory/232-1714-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/232-1835-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/552-66-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/552-3738-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/552-579-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/628-2555-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/692-4850-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/804-1982-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/804-1855-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/852-4680-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/976-1721-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1072-2593-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1072-2768-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1120-1457-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1196-1856-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1196-912-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1328-2080-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1328-2211-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1336-1337-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1388-1853-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1444-1847-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1476-712-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1476-1725-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1564-1013-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1592-2131-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1796-1395-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1844-65-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1844-60-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1896-3273-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1904-2153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-2432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2000-2430-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-2239-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-2394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2236-2113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-2440-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2428-1394-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2640-1780-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2640-856-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2676-3060-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-1336-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-2412-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-3998-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2872-1069-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2880-4868-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3000-2603-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3112-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3112-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3112-57-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/3112-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-3051-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-1935-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3548-3911-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3620-4839-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-2093-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-2089-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3700-4543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4036-2251-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-2616-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4060-3264-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4176-1141-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4236-1580-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4240-1727-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4304-1779-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4328-1652-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4404-1080-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4428-1947-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4500-1715-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4500-711-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4592-4718-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4592-4722-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-2101-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4752-3876-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4816-1263-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4868-4523-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4880-3321-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4948-1518-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4992-3775-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-1724-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-1722-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5096-21-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5096-29-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5096-22-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/5096-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/5200-4551-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5336-4978-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5336-4828-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5396-4994-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5396-5108-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5680-4609-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5680-4431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5704-4831-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5728-4800-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5844-4353-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5940-4245-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6020-4858-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6076-4513-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download