Analysis

  • max time kernel
    118s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 09:04

General

  • Target

    006ed1949f1e8309a2cea9cd84e812d0_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    006ed1949f1e8309a2cea9cd84e812d0

  • SHA1

    42cb4f0bd8f6859fd56c6d50d14cb5e10bf8a41f

  • SHA256

    10d74365ffe0808c1733de8e04567b07d0b462dc5f2dd547091ce5604039a10e

  • SHA512

    4aa074eae3092190b7d66ab03b55b37c4c2505eaf701f6b366334c7fd6ad7bfc4e98ef4100e1ee2d5fe98069870abbc52a6a4bed3cfca56a3ef251864371867e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZN:0UzeyQMS4DqodCnoe+iitjWwwh

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 27 IoCs
  • Drops file in Windows directory 44 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\006ed1949f1e8309a2cea9cd84e812d0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\006ed1949f1e8309a2cea9cd84e812d0_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4452
      • C:\Users\Admin\AppData\Local\Temp\006ed1949f1e8309a2cea9cd84e812d0_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\006ed1949f1e8309a2cea9cd84e812d0_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3400
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:408
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5108
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4516
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3532
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3760
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5976
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2004
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4864
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:4576
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4892
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3772
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5116
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2440
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5236
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2024
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5680
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:5752
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:5100
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4056
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5780
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4572
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5872
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4468
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5964
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4924
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5452
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      PID:5596
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:5796
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:448
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5644
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2888
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:6008
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2956
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:6076
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4980
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5216
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:5364
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:6052
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1048
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:5380
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:2456
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:5988
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          PID:6072
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:5176
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3688
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:5600
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1244
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:5628
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            PID:1220
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:4040
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:452
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4868
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2720
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:5700
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1500
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1528
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:5020
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:6140
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:548
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2924
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              PID:5792
                              • \??\c:\windows\system\explorer.exe
                                "c:\windows\system\explorer.exe"
                                8⤵
                                  PID:2620
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:964
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1516
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3192
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:5472
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                  PID:5296
                                  • \??\c:\windows\system\explorer.exe
                                    "c:\windows\system\explorer.exe"
                                    8⤵
                                      PID:1472
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                PID:5168
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:5140
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                        PID:2444
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:5148
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:5188
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                            PID:6064
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:1600
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:2324
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                                PID:6056
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            PID:4364
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:368
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              PID:4168
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:5828
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    7⤵
                                                      PID:1796
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  PID:5916
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:4456
                                                      • \??\c:\windows\system\explorer.exe
                                                        c:\windows\system\explorer.exe
                                                        7⤵
                                                          PID:5704
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      PID:5640
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:5272
                                                          • \??\c:\windows\system\explorer.exe
                                                            c:\windows\system\explorer.exe
                                                            7⤵
                                                              PID:3692
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:3460
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:2996
                                                                • \??\c:\windows\system\explorer.exe
                                                                  c:\windows\system\explorer.exe
                                                                  7⤵
                                                                    PID:5312
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:3552
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    "c:\windows\system\spoolsv.exe"
                                                                    6⤵
                                                                      PID:5720
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                      PID:6080
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        "c:\windows\system\spoolsv.exe"
                                                                        6⤵
                                                                          PID:4640
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:5448
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            "c:\windows\system\spoolsv.exe"
                                                                            6⤵
                                                                              PID:5756
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:212
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:3452
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:5676
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:5864
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:5992
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:4104
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:5552
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:5232
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:5200
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:5560
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:5488
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:4848
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:1820
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                              1⤵
                                                                                                PID:1460

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Windows\Parameters.ini

                                                                                                      Filesize

                                                                                                      74B

                                                                                                      MD5

                                                                                                      6687785d6a31cdf9a5f80acb3abc459b

                                                                                                      SHA1

                                                                                                      1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                      SHA256

                                                                                                      3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                      SHA512

                                                                                                      5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                    • C:\Windows\System\explorer.exe

                                                                                                      Filesize

                                                                                                      2.2MB

                                                                                                      MD5

                                                                                                      e68159e57e0079fa505969c9911b0bd4

                                                                                                      SHA1

                                                                                                      57e8c31d4e277bb4df55c7b83856fa1a02975490

                                                                                                      SHA256

                                                                                                      21e304df13a23059bc06ef0d156e2d3075c926fe849b0c276decdb81902105f8

                                                                                                      SHA512

                                                                                                      71cb501a8bab26e9975ee92b91aeaaafb93bc588b7b793d35d2a4713d28783aeae5b78dac44af0b7fa0b5aa2757128568d4df15954ddbe33cb052a2b3085ce65

                                                                                                    • C:\Windows\System\spoolsv.exe

                                                                                                      Filesize

                                                                                                      2.2MB

                                                                                                      MD5

                                                                                                      1dfbe2035128ebe32668b9baf35e020c

                                                                                                      SHA1

                                                                                                      1c2dc5af19a212e3fb205126ec4d142607841d21

                                                                                                      SHA256

                                                                                                      a76d466506a6bfbdf22d3820a43ebbd59565bce36c03de764292d8ea5eb8186f

                                                                                                      SHA512

                                                                                                      f862b266f2ba987919421bde56cd6632c938180705726f666c1525deb436d0a189d0b6e1c25feedff6e51a0b488ffd1b29c81ca2b7007e3a899961df1ba3e547

                                                                                                    • memory/408-42-0x0000000002230000-0x0000000002231000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/408-97-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/408-93-0x0000000002230000-0x0000000002231000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/408-91-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/448-675-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/448-1219-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/448-1289-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/452-1673-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/548-1396-0x0000000000720000-0x0000000000721000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/548-1601-0x0000000000720000-0x0000000000721000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/964-1684-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/964-1451-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1048-1394-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/1244-1597-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/1244-1534-0x0000000000770000-0x0000000000771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1244-1115-0x0000000000770000-0x0000000000771000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1500-1592-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1500-1290-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2004-674-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2004-157-0x0000000000730000-0x0000000000731000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2004-821-0x0000000000730000-0x0000000000731000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2004-1586-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2024-346-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2024-865-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2024-1005-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2440-820-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2440-285-0x00000000021D0000-0x00000000021D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2440-1688-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2440-933-0x00000000021D0000-0x00000000021D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2456-1466-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2456-1006-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2456-1448-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2720-1589-0x0000000000780000-0x0000000000781000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2720-1221-0x0000000000780000-0x0000000000781000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2888-761-0x0000000002300000-0x0000000002301000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2888-1288-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2888-1349-0x0000000002300000-0x0000000002301000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2956-822-0x0000000002310000-0x0000000002311000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2956-1347-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/2956-1395-0x0000000002310000-0x0000000002311000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3192-1540-0x0000000000640000-0x0000000000641000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3192-1793-0x0000000000640000-0x0000000000641000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3400-29-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/3400-85-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/3400-84-0x0000000000440000-0x0000000000509000-memory.dmp

                                                                                                      Filesize

                                                                                                      804KB

                                                                                                    • memory/3400-31-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/3532-1468-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/3532-1571-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/3688-1470-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3688-1587-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/3688-1062-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3760-1791-0x0000000000790000-0x0000000000791000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3760-1471-0x0000000000790000-0x0000000000791000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3772-1599-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/3772-227-0x0000000000830000-0x0000000000831000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3772-745-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/3772-866-0x0000000000830000-0x0000000000831000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4056-1004-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4056-420-0x0000000000680000-0x0000000000681000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4056-1049-0x0000000000680000-0x0000000000681000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4384-34-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4384-28-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4384-0-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4384-26-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4468-549-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4468-1050-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4468-1162-0x0000000002200000-0x0000000002201000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4516-1464-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4516-751-0x0000000000640000-0x0000000000641000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4516-548-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4516-107-0x0000000000640000-0x0000000000641000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4572-486-0x0000000000870000-0x0000000000871000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4572-1048-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4572-1114-0x0000000000870000-0x0000000000871000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4576-1806-0x0000000002330000-0x0000000002331000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4576-1593-0x0000000002330000-0x0000000002331000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4864-1773-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/4924-1108-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4924-615-0x0000000000750000-0x0000000000751000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4924-1220-0x0000000000750000-0x0000000000751000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4980-872-0x0000000002100000-0x0000000002101000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4980-1449-0x0000000002100000-0x0000000002101000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4980-1348-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/5108-98-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5108-547-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5116-1606-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5116-1603-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5168-1686-0x0000000000760000-0x0000000000761000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/5236-1695-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5752-1795-0x0000000000790000-0x0000000000791000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/5780-1804-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5780-1805-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5780-1810-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5872-1819-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5872-1823-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5964-1832-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5964-1833-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB

                                                                                                    • memory/5964-1839-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                      Filesize

                                                                                                      248KB