pony | f41e3a0d690baff50b976700da68c03e3d4bb123c90f8891db2628794872c0ef

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
Size

2.2MB
MD5

ffec4e7389c68450cef4e9f2fc50c744
SHA1

d614545340fcf4a5c720a9734182b165340a4991
SHA256

f41e3a0d690baff50b976700da68c03e3d4bb123c90f8891db2628794872c0ef
SHA512

fc09906592efa4e6f90dc0d78f4481e50b52d65123fa50a887e75c4c62d672431d44b27a459de893900107ddadc55c465021587ab20f12b547864f5b0120952b
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWwwA

Score

10^/10

pony discovery evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2736	explorer.exe
2060	explorer.exe
2000	spoolsv.exe
1176	spoolsv.exe
1364	spoolsv.exe
3064	spoolsv.exe
680	spoolsv.exe
2816	spoolsv.exe
2660	spoolsv.exe
1912	spoolsv.exe
2224	spoolsv.exe
1468	spoolsv.exe
1348	spoolsv.exe
1656	spoolsv.exe
1752	spoolsv.exe
2808	spoolsv.exe
1700	spoolsv.exe
1756	spoolsv.exe
628	spoolsv.exe
1644	spoolsv.exe
2380	spoolsv.exe
2732	spoolsv.exe
1876	spoolsv.exe
2328	spoolsv.exe
1980	spoolsv.exe
1460	spoolsv.exe
2312	spoolsv.exe
1044	spoolsv.exe
2052	spoolsv.exe
1472	spoolsv.exe
1012	spoolsv.exe
1028	spoolsv.exe
916	spoolsv.exe
1156	spoolsv.exe
2324	spoolsv.exe
824	spoolsv.exe
1600	spoolsv.exe
1144	spoolsv.exe
2308	spoolsv.exe
2112	spoolsv.exe
1048	spoolsv.exe
2780	spoolsv.exe
2936	spoolsv.exe
1016	spoolsv.exe
1748	spoolsv.exe
1312	spoolsv.exe
1648	spoolsv.exe
1960	spoolsv.exe
1804	spoolsv.exe
432	spoolsv.exe
1476	spoolsv.exe
1328	spoolsv.exe
2168	spoolsv.exe
1536	spoolsv.exe
1972	spoolsv.exe
2772	spoolsv.exe
1588	spoolsv.exe
2728	spoolsv.exe
2192	spoolsv.exe
2988	spoolsv.exe
2928	spoolsv.exe
2688	spoolsv.exe
876	explorer.exe
3000	spoolsv.exe

Loads dropped DLL 64 IoCs

pid	Process
2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 38 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 2852	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	31
PID 2736 set thread context of 2060	2736	explorer.exe	33
PID 2000 set thread context of 2688	2000	spoolsv.exe	93
PID 1176 set thread context of 3000	1176	spoolsv.exe	95
PID 1364 set thread context of 2700	1364	spoolsv.exe	96
PID 3064 set thread context of 2896	3064	spoolsv.exe	97
PID 680 set thread context of 2160	680	spoolsv.exe	99
PID 2816 set thread context of 3104	2816	spoolsv.exe	100
PID 2660 set thread context of 3528	2660	spoolsv.exe	102
PID 1912 set thread context of 3604	1912	spoolsv.exe	103
PID 2224 set thread context of 3696	2224	spoolsv.exe	104
PID 1468 set thread context of 3708	1468	spoolsv.exe	105
PID 1656 set thread context of 3780	1656	spoolsv.exe	107
PID 1348 set thread context of 3820	1348	spoolsv.exe	108
PID 1752 set thread context of 3864	1752	spoolsv.exe	109
PID 2808 set thread context of 3872	2808	spoolsv.exe	110
PID 2988 set thread context of 3952	2988	spoolsv.exe	111
PID 1756 set thread context of 3964	1756	spoolsv.exe	112
PID 1700 set thread context of 3972	1700	spoolsv.exe	113
PID 1644 set thread context of 4000	1644	spoolsv.exe	114
PID 2732 set thread context of 4068	2732	spoolsv.exe	115
PID 628 set thread context of 3148	628	spoolsv.exe	116
PID 2380 set thread context of 1084	2380	spoolsv.exe	118
PID 2328 set thread context of 3340	2328	spoolsv.exe	119
PID 1460 set thread context of 1020	1460	spoolsv.exe	120
PID 1876 set thread context of 1668	1876	spoolsv.exe	121
PID 1980 set thread context of 3580	1980	spoolsv.exe	122
PID 1044 set thread context of 2996	1044	spoolsv.exe	123
PID 1472 set thread context of 3752	1472	spoolsv.exe	124
PID 1028 set thread context of 1652	1028	spoolsv.exe	125
PID 824 set thread context of 1688	824	spoolsv.exe	126
PID 1012 set thread context of 2152	1012	spoolsv.exe	127
PID 2312 set thread context of 1264	2312	spoolsv.exe	128
PID 1156 set thread context of 3860	1156	spoolsv.exe	129
PID 2052 set thread context of 3900	2052	spoolsv.exe	130
PID 1144 set thread context of 3936	1144	spoolsv.exe	131
PID 2112 set thread context of 3944	2112	spoolsv.exe	132
PID 2780 set thread context of 2032	2780	spoolsv.exe	133

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	explorer.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2060	explorer.exe
2688	spoolsv.exe
2688	spoolsv.exe
3000	spoolsv.exe
3000	spoolsv.exe
2700	spoolsv.exe
2700	spoolsv.exe
2896	spoolsv.exe
2896	spoolsv.exe
2160	spoolsv.exe
2160	spoolsv.exe
3104	spoolsv.exe
3104	spoolsv.exe
3528	spoolsv.exe
3708	spoolsv.exe
3604	spoolsv.exe
3708	spoolsv.exe
3696	spoolsv.exe
3604	spoolsv.exe
3696	spoolsv.exe
3528	spoolsv.exe
3780	spoolsv.exe
4068	spoolsv.exe
3780	spoolsv.exe
4068	spoolsv.exe
3952	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2724	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2724	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2724	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2724	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	30
PID 2808 wrote to memory of 2852	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2852	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2852	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2852	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2852	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	31
PID 2808 wrote to memory of 2852	2808	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	31
PID 2852 wrote to memory of 2736	2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	32
PID 2852 wrote to memory of 2736	2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	32
PID 2852 wrote to memory of 2736	2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	32
PID 2852 wrote to memory of 2736	2852	ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe	32
PID 2736 wrote to memory of 2060	2736	explorer.exe	33
PID 2736 wrote to memory of 2060	2736	explorer.exe	33
PID 2736 wrote to memory of 2060	2736	explorer.exe	33
PID 2736 wrote to memory of 2060	2736	explorer.exe	33
PID 2736 wrote to memory of 2060	2736	explorer.exe	33
PID 2736 wrote to memory of 2060	2736	explorer.exe	33
PID 2060 wrote to memory of 2000	2060	explorer.exe	34
PID 2060 wrote to memory of 2000	2060	explorer.exe	34
PID 2060 wrote to memory of 2000	2060	explorer.exe	34
PID 2060 wrote to memory of 2000	2060	explorer.exe	34
PID 2060 wrote to memory of 1176	2060	explorer.exe	35
PID 2060 wrote to memory of 1176	2060	explorer.exe	35
PID 2060 wrote to memory of 1176	2060	explorer.exe	35
PID 2060 wrote to memory of 1176	2060	explorer.exe	35
PID 2060 wrote to memory of 1364	2060	explorer.exe	36
PID 2060 wrote to memory of 1364	2060	explorer.exe	36
PID 2060 wrote to memory of 1364	2060	explorer.exe	36
PID 2060 wrote to memory of 1364	2060	explorer.exe	36
PID 2060 wrote to memory of 3064	2060	explorer.exe	37
PID 2060 wrote to memory of 3064	2060	explorer.exe	37
PID 2060 wrote to memory of 3064	2060	explorer.exe	37
PID 2060 wrote to memory of 3064	2060	explorer.exe	37
PID 2060 wrote to memory of 680	2060	explorer.exe	38
PID 2060 wrote to memory of 680	2060	explorer.exe	38
PID 2060 wrote to memory of 680	2060	explorer.exe	38
PID 2060 wrote to memory of 680	2060	explorer.exe	38
PID 2060 wrote to memory of 2816	2060	explorer.exe	39
PID 2060 wrote to memory of 2816	2060	explorer.exe	39
PID 2060 wrote to memory of 2816	2060	explorer.exe	39
PID 2060 wrote to memory of 2816	2060	explorer.exe	39
PID 2060 wrote to memory of 2660	2060	explorer.exe	40
PID 2060 wrote to memory of 2660	2060	explorer.exe	40
PID 2060 wrote to memory of 2660	2060	explorer.exe	40
PID 2060 wrote to memory of 2660	2060	explorer.exe	40
PID 2060 wrote to memory of 1912	2060	explorer.exe	41
PID 2060 wrote to memory of 1912	2060	explorer.exe	41
PID 2060 wrote to memory of 1912	2060	explorer.exe	41
PID 2060 wrote to memory of 1912	2060	explorer.exe	41
PID 2060 wrote to memory of 2224	2060	explorer.exe	42
PID 2060 wrote to memory of 2224	2060	explorer.exe	42
PID 2060 wrote to memory of 2224	2060	explorer.exe	42
PID 2060 wrote to memory of 2224	2060	explorer.exe	42
PID 2060 wrote to memory of 1468	2060	explorer.exe	43
PID 2060 wrote to memory of 1468	2060	explorer.exe	43
PID 2060 wrote to memory of 1468	2060	explorer.exe	43
PID 2060 wrote to memory of 1468	2060	explorer.exe	43
PID 2060 wrote to memory of 1348	2060	explorer.exe	44
PID 2060 wrote to memory of 1348	2060	explorer.exe	44
PID 2060 wrote to memory of 1348	2060	explorer.exe	44
PID 2060 wrote to memory of 1348	2060	explorer.exe	44

C:\Users\Admin\AppData\Local\Temp\ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ffec4e7389c68450cef4e9f2fc50c744_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - \??\c:\windows\system\explorer.exe
      "c:\windows\system\explorer.exe"
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2000
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        \??\c:\windows\system\explorer.exe
        
        c:\windows\system\explorer.exe
        7⤵
        Executes dropped EXE
        
        PID:876
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1176
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1364
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3064
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:680
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2160
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2816
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3104
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2660
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3528
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1912
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2224
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3696
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1468
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3708
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1348
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3820
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1656
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3780
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1752
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3864
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2808
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3872
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1700
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3972
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1756
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:628
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3148
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1644
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2380
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1084
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2732
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4068
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1876
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3340
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1980
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3580
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1460
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1020
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1264
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1044
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2996
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2052
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:1472
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1012
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2152
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1028
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1652
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:916
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2764
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1156
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2324
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2480
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:824
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1688
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1600
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3216
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1144
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2308
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2112
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3944
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1048
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3512
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2780
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2032
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2936
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3844
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1016
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:4056
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1748
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1948
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1312
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3392
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1648
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1960
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1804
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:432
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3740
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1476
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3776
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1328
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:904
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2168
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1536
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3724
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1972
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2164
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2772
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3044
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1588
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:2352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2728
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:1604
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2192
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        
        PID:3324
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        
        PID:2988
      - \??\c:\windows\system\spoolsv.exe
        
        "c:\windows\system\spoolsv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3952
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2928
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2272
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3768
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3224
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4040
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2672
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini

Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
\Windows\system\explorer.exe

Filesize
2.2MB

MD5
1973cff4ea7da24398f92f799ea2c303

SHA1
b8d74395883f90855b9297c44c0220bb006e1a1f

SHA256
ac83038c4d9ff725f22fdc5b5726a1a573f6b3c779d408e4925f4ca8c22af479

SHA512
982e201efaf761c577f929236b7ecf2d52c01b2d11f904ef30e59dad70800ceb1f7ed2f33dadf896168a12835d778db388bbdeb4243a310a018430620210fc8f

Download Submit
\Windows\system\spoolsv.exe

Filesize
2.2MB

MD5
39cb3b4e4fbbbed26385555f6648840b

SHA1
aee291184a56666f6747b65a63f8abd7bbce7a47

SHA256
750cdac0366f67fffe3e1ee2727bc819e938518dfc645aaa6a245326246997f8

SHA512
41932ee735d8c61e906a30aefcb79e123a8ed9a412be661dbda7600ef332a1449827a1c4af7ceb3a599e770939d3d8852f5abf7e1812947cdf96006f36f0155d

Download Submit
memory/628-1695-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/680-1244-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/956-3234-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1012-2174-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1020-3253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1028-2175-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1044-2084-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1176-1039-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1348-1529-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1364-1040-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1460-1991-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1468-1528-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1472-2173-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1604-3251-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1644-1792-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1652-3242-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-1605-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1688-3209-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1700-1693-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1752-1606-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1756-1694-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1876-1897-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1912-1414-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1980-1990-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2000-941-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2052-2085-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2060-820-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2160-2635-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2164-3235-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2224-1527-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2312-1992-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2328-1898-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2380-1793-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2388-3243-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2660-1341-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2688-2554-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-2457-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2700-2499-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2732-1896-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2736-71-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2736-61-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2736-42-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2808-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2808-29-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2808-16-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2808-1607-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2808-17-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2816-1340-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2852-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-50-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-27-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2852-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2896-2514-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2996-3218-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3000-2468-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3044-3250-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3064-1138-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3324-3241-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3512-3309-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3528-3198-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3604-3133-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3616-3254-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3708-3114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3780-3157-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3800-3252-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3820-3215-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3860-3244-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3864-3216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3972-3123-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4000-3255-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4068-3136-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download