pony | a83465f70d10a517fdf17a8dd7643b07f9768f00bbcbcfe862ae4cc7de9109a1

Analysis

max time kernel
101s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
Size

2.2MB
MD5

d2998c2273032396dcee2efa581590f5
SHA1

f137253de8aa951bb70aefab5b1462208fb19d9a
SHA256

a83465f70d10a517fdf17a8dd7643b07f9768f00bbcbcfe862ae4cc7de9109a1
SHA512

29da6d9a9341e73d9d80f826f542a4e3d9a51bcc920401db932f32d45443bd3a2726c5980e29bccfad77d49547ad1148747812d8c37f5a985f52e5c5c8eecdae
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZN:0UzeyQMS4DqodCnoe+iitjWwwh

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe

Executes dropped EXE 52 IoCs

pid	Process
1936	explorer.exe
5032	explorer.exe
4884	spoolsv.exe
4232	spoolsv.exe
1628	spoolsv.exe
2828	spoolsv.exe
4116	spoolsv.exe
1880	spoolsv.exe
2320	spoolsv.exe
3136	spoolsv.exe
4872	spoolsv.exe
1424	spoolsv.exe
3752	spoolsv.exe
4196	spoolsv.exe
4596	spoolsv.exe
2484	spoolsv.exe
3728	spoolsv.exe
3448	spoolsv.exe
1100	spoolsv.exe
3404	spoolsv.exe
4396	spoolsv.exe
1772	spoolsv.exe
4148	spoolsv.exe
4712	spoolsv.exe
3144	spoolsv.exe
4820	spoolsv.exe
2820	explorer.exe
5232	spoolsv.exe
5312	spoolsv.exe
5712	spoolsv.exe
5756	explorer.exe
6028	spoolsv.exe
6096	spoolsv.exe
5252	spoolsv.exe
724	explorer.exe
5548	spoolsv.exe
5728	spoolsv.exe
5152	spoolsv.exe
5724	spoolsv.exe
5204	explorer.exe
5520	spoolsv.exe
6020	spoolsv.exe
6076	explorer.exe
5200	spoolsv.exe
5356	spoolsv.exe
5896	spoolsv.exe
5264	spoolsv.exe
6016	explorer.exe
5344	spoolsv.exe
3300	spoolsv.exe
5736	explorer.exe
404	spoolsv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 3740	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	97
PID 1936 set thread context of 5032	1936	explorer.exe	107
PID 4884 set thread context of 4820	4884	spoolsv.exe	131
PID 4232 set thread context of 5312	4232	spoolsv.exe	134
PID 1628 set thread context of 5712	1628	spoolsv.exe	135
PID 2828 set thread context of 6096	2828	spoolsv.exe	138
PID 4116 set thread context of 5252	4116	spoolsv.exe	139
PID 1880 set thread context of 5728	1880	spoolsv.exe	142
PID 2320 set thread context of 5724	2320	spoolsv.exe	144
PID 3136 set thread context of 6020	3136	spoolsv.exe	147
PID 4872 set thread context of 5356	4872	spoolsv.exe	150
PID 1424 set thread context of 5264	1424	spoolsv.exe	152
PID 3752 set thread context of 3300	3752	spoolsv.exe	155

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3740	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
3740	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
3740	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
3740	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
5032	explorer.exe
4820	spoolsv.exe
4820	spoolsv.exe
5312	spoolsv.exe
5312	spoolsv.exe
5712	spoolsv.exe
5712	spoolsv.exe
6096	spoolsv.exe
6096	spoolsv.exe
5252	spoolsv.exe
5252	spoolsv.exe
5728	spoolsv.exe
5728	spoolsv.exe
5724	spoolsv.exe
5724	spoolsv.exe
6020	spoolsv.exe
6020	spoolsv.exe
5356	spoolsv.exe
5356	spoolsv.exe
5264	spoolsv.exe
5264	spoolsv.exe
3300	spoolsv.exe
3300	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 844	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	90
PID 5032 wrote to memory of 844	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	90
PID 5032 wrote to memory of 3740	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	97
PID 5032 wrote to memory of 3740	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	97
PID 5032 wrote to memory of 3740	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	97
PID 5032 wrote to memory of 3740	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	97
PID 5032 wrote to memory of 3740	5032	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	97
PID 3740 wrote to memory of 1936	3740	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	98
PID 3740 wrote to memory of 1936	3740	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	98
PID 3740 wrote to memory of 1936	3740	d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe	98
PID 1936 wrote to memory of 5032	1936	explorer.exe	107
PID 1936 wrote to memory of 5032	1936	explorer.exe	107
PID 1936 wrote to memory of 5032	1936	explorer.exe	107
PID 1936 wrote to memory of 5032	1936	explorer.exe	107
PID 1936 wrote to memory of 5032	1936	explorer.exe	107
PID 5032 wrote to memory of 4884	5032	explorer.exe	108
PID 5032 wrote to memory of 4884	5032	explorer.exe	108
PID 5032 wrote to memory of 4884	5032	explorer.exe	108
PID 5032 wrote to memory of 4232	5032	explorer.exe	109
PID 5032 wrote to memory of 4232	5032	explorer.exe	109
PID 5032 wrote to memory of 4232	5032	explorer.exe	109
PID 5032 wrote to memory of 1628	5032	explorer.exe	110
PID 5032 wrote to memory of 1628	5032	explorer.exe	110
PID 5032 wrote to memory of 1628	5032	explorer.exe	110
PID 5032 wrote to memory of 2828	5032	explorer.exe	111
PID 5032 wrote to memory of 2828	5032	explorer.exe	111
PID 5032 wrote to memory of 2828	5032	explorer.exe	111
PID 5032 wrote to memory of 4116	5032	explorer.exe	112
PID 5032 wrote to memory of 4116	5032	explorer.exe	112
PID 5032 wrote to memory of 4116	5032	explorer.exe	112
PID 5032 wrote to memory of 1880	5032	explorer.exe	113
PID 5032 wrote to memory of 1880	5032	explorer.exe	113
PID 5032 wrote to memory of 1880	5032	explorer.exe	113
PID 5032 wrote to memory of 2320	5032	explorer.exe	114
PID 5032 wrote to memory of 2320	5032	explorer.exe	114
PID 5032 wrote to memory of 2320	5032	explorer.exe	114
PID 5032 wrote to memory of 3136	5032	explorer.exe	115
PID 5032 wrote to memory of 3136	5032	explorer.exe	115
PID 5032 wrote to memory of 3136	5032	explorer.exe	115
PID 5032 wrote to memory of 4872	5032	explorer.exe	116
PID 5032 wrote to memory of 4872	5032	explorer.exe	116
PID 5032 wrote to memory of 4872	5032	explorer.exe	116
PID 5032 wrote to memory of 1424	5032	explorer.exe	117
PID 5032 wrote to memory of 1424	5032	explorer.exe	117
PID 5032 wrote to memory of 1424	5032	explorer.exe	117
PID 5032 wrote to memory of 3752	5032	explorer.exe	118
PID 5032 wrote to memory of 3752	5032	explorer.exe	118
PID 5032 wrote to memory of 3752	5032	explorer.exe	118
PID 5032 wrote to memory of 4196	5032	explorer.exe	119
PID 5032 wrote to memory of 4196	5032	explorer.exe	119
PID 5032 wrote to memory of 4196	5032	explorer.exe	119
PID 5032 wrote to memory of 4596	5032	explorer.exe	120
PID 5032 wrote to memory of 4596	5032	explorer.exe	120
PID 5032 wrote to memory of 4596	5032	explorer.exe	120
PID 5032 wrote to memory of 2484	5032	explorer.exe	121
PID 5032 wrote to memory of 2484	5032	explorer.exe	121
PID 5032 wrote to memory of 2484	5032	explorer.exe	121
PID 5032 wrote to memory of 3728	5032	explorer.exe	122
PID 5032 wrote to memory of 3728	5032	explorer.exe	122
PID 5032 wrote to memory of 3728	5032	explorer.exe	122
PID 5032 wrote to memory of 3448	5032	explorer.exe	123
PID 5032 wrote to memory of 3448	5032	explorer.exe	123
PID 5032 wrote to memory of 3448	5032	explorer.exe	123
PID 5032 wrote to memory of 1100	5032	explorer.exe	124

C:\Users\Admin\AppData\Local\Temp\d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:844
- C:\Users\Admin\AppData\Local\Temp\d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d2998c2273032396dcee2efa581590f5_JaffaCakes118.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3740
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4884
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4820
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5312
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5712
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:1532
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2828
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4116
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5252
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:724
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1880
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5728
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2320
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5724
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:4992
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3136
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6020
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:6032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4872
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1424
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5264
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3300
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5608
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1580
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5416
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2236
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4596
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5792
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1612
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5512
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5364
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:396
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5144
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3448
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5492
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1100
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2272
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5216
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:3868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5916
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4396
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5172
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4536
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4148
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4572
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:4696
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:2020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4712
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:6140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4140
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5256
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:5632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5232
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:540
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1016
        
        \??\c:\windows\system\explorer.exe
        
        "c:\windows\system\explorer.exe"
        8⤵
        
        PID:816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5812
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:1168
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5548
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2156
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5152
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5520
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5784
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5200
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5184
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5896
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5552
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5344
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2832
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:404
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4260
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5984
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5028
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5976
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5788
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5192
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5484
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3508
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3212
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5260
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2344
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:2996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2672
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:740
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5420
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5684
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:5908
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:3948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1616
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5196
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3220
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:60
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4688
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        
        PID:5524
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2744
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4276
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:412
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5012
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2908
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:5600
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3132
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:8
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
2.2MB

MD5
377e89c4385df2fa5f1a1544c6d44034

SHA1
58a883fc76a74e00ac8ad005b45d1472c062b754

SHA256
501c0b2229d3ffad4706e5dea67d15880b1c14ae60380410facfdda7c870815f

SHA512
2934f5002e94445732b2c620da9b67746e9f921909274c902f1cb9ce382f97d0967ca24250a4508c5c7cef0a679d8c7949d99029a47ec89001d723572cbe2000

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
2.2MB

MD5
62485a6d6baee13db4a9e82383ce07bf

SHA1
dcd4b1abfaff8ab83221d85ac809a1aa17dcf20b

SHA256
a0a3dacb8a791a8685334fe2cf191e31eae0cb0090537bc02caf45f8032961ed

SHA512
93b7a6e0c158628d500dc77eed79078e8e1544477a78d817fc9d0aa3b4078b8faf9f345af0cb6f6df459476bc2b444e8809cbb4e6719a752118ca1907bf3aa1b

Download Submit
memory/216-4157-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-3037-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/540-4032-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/816-5279-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1100-1637-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1424-1147-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1532-4065-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1580-2690-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1612-2788-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1612-2889-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1628-1639-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1628-698-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1768-4837-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1768-4842-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1880-900-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1936-75-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1936-69-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2020-4930-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-5085-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2156-4164-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2236-4366-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2272-3102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2272-3229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2320-978-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2344-4826-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2344-4997-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2484-1440-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2828-1716-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2828-763-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2832-4333-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2964-4891-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3136-1029-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3212-4682-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3220-5107-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3220-5102-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3300-2546-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3300-2435-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3404-1711-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3448-1547-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3508-4560-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3728-1457-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3740-29-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3740-30-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3740-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3752-1224-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4116-774-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4140-3684-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4196-1276-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4232-1550-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4232-648-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4276-5289-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4396-1770-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4572-3439-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4596-1389-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4688-5347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-5269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4820-1458-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4820-1620-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4868-3773-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-1075-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4884-520-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4884-1459-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5028-4451-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-26-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5032-33-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/5032-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/5032-27-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/5032-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-458-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5064-4373-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-4177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5140-4325-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5172-3268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5184-4304-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5220-3321-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5252-1776-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5252-1887-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5264-2294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5264-2418-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5312-1548-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5312-1552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5312-1549-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/5356-2191-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5364-4536-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5492-2993-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5492-2985-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5528-4354-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5608-4348-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5712-1758-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5712-1638-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5724-2071-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5728-1849-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5728-1844-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5776-4558-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5784-4194-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5788-4543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5788-4660-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5792-2637-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5812-4143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5812-4275-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5916-3187-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5916-3191-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6020-2105-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6020-2230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6032-4297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6096-1712-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6096-1715-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6140-3588-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download