pony | 0bc6da2c6448f0dd8c7d2b7cf8e17ab81f3d81d8830d32d499d3ccf24262ca3b

Analysis

max time kernel
59s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
Size

2.2MB
MD5

007c34ba8f405ebca7389a7e9c911b91
SHA1

bb968484cb75940e84e80cfdb7b751d669190ed2
SHA256

0bc6da2c6448f0dd8c7d2b7cf8e17ab81f3d81d8830d32d499d3ccf24262ca3b
SHA512

876485294a269d4835d990c6ae79e661b2879ecc9a1b603fa1d61687c2c0d063d5f54c77af49770fbf11ebdea4a51d7f664843065edbaa2118383930c2ef36cd
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwJ

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe

Executes dropped EXE 6 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid process

2644 explorer.exe
2828 explorer.exe
2216 spoolsv.exe
1292 spoolsv.exe
1864 spoolsv.exe
1856 spoolsv.exe

pid	process
2644	explorer.exe
2828	explorer.exe
2216	spoolsv.exe
1292	spoolsv.exe
1864	spoolsv.exe
1856	spoolsv.exe

Loads dropped DLL 10 IoCs

Processes:

007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exeexplorer.exe

pid	process
2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exeexplorer.exe

description	pid	process	target process
PID 2180 set thread context of 2496	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
PID 2644 set thread context of 2828	2644	explorer.exe	explorer.exe

Drops file in Windows directory 8 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exeexplorer.exe

pid process

2496 007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
2828 explorer.exe
2828 explorer.exe
2828 explorer.exe
2828 explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exeexplorer.exe

pid	process
2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe
2828	explorer.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exeexplorer.exeexplorer.exe

description	pid	process	target process
PID 2180 wrote to memory of 548	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	splwow64.exe
PID 2180 wrote to memory of 548	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	splwow64.exe
PID 2180 wrote to memory of 548	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	splwow64.exe
PID 2180 wrote to memory of 548	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	splwow64.exe
PID 2180 wrote to memory of 2496	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
PID 2180 wrote to memory of 2496	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
PID 2180 wrote to memory of 2496	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
PID 2180 wrote to memory of 2496	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
PID 2180 wrote to memory of 2496	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
PID 2180 wrote to memory of 2496	2180	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
PID 2496 wrote to memory of 2644	2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	explorer.exe
PID 2496 wrote to memory of 2644	2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	explorer.exe
PID 2496 wrote to memory of 2644	2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	explorer.exe
PID 2496 wrote to memory of 2644	2496	007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe	explorer.exe
PID 2644 wrote to memory of 2828	2644	explorer.exe	explorer.exe
PID 2644 wrote to memory of 2828	2644	explorer.exe	explorer.exe
PID 2644 wrote to memory of 2828	2644	explorer.exe	explorer.exe
PID 2644 wrote to memory of 2828	2644	explorer.exe	explorer.exe
PID 2644 wrote to memory of 2828	2644	explorer.exe	explorer.exe
PID 2644 wrote to memory of 2828	2644	explorer.exe	explorer.exe
PID 2828 wrote to memory of 2216	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 2216	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 2216	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 2216	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1292	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1292	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1292	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1292	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1864	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1864	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1864	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1864	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1856	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1856	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1856	2828	explorer.exe	spoolsv.exe
PID 2828 wrote to memory of 1856	2828	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:548

C:\Users\Admin\AppData\Local\Temp\007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\007c34ba8f405ebca7389a7e9c911b91_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2644

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2216

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:876

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1292

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2444

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:928

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1864

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3168

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1856

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1200

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1996

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4004

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2716

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3576

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2180

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2008

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2416

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4056

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2068

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3676

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1700

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1636

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1508

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4072

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2276

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3236

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1568

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3132

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3008

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3672

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2628

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2524

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2536

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3996

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2208

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1624

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3228

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1344

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:280

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2876

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2596

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1948

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1528

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1336

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2424

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1584

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2948

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2420

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2192

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1656

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1968

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2072

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2720

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2852

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1660

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:968

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:868

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2632

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:564

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1492

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1664

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2156

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2320

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:832

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3044

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2888

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2292

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:768

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2116

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2432

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1424

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1580

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2756

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2680

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2692

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:824

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1296

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1872

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2356

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1984

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1252

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2840

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1288

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1976

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:972

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3648

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2480

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1380

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3552

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3980

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1060

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3884

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\Parameters.ini
Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
\Windows\system\explorer.exe
Filesize
2.2MB

MD5
3457997122f19947bb18c3704e86e4fa

SHA1
8b47f03be1ecc9c78887eeddf9917a51b6006114

SHA256
c566dcf3b61abeaaba387ab93e7f834a9e546e9fd8d57177698d5a632a7d3b5e

SHA512
7182bc9e138ee8cae8b2af63141688ffaed74a235df5c5f39c7c4432d9cd2bdb5a88e86e0ab05fed8f5efccfa9f9d0c7b0ce53d26192dc5b0ddd5ee9262e4418

Download Submit
\Windows\system\spoolsv.exe
Filesize
2.2MB

MD5
49eafc13d52228366e5a6d205a7824a1

SHA1
082e209705a29222030ffef865460f820e7635d1

SHA256
f04d02c0f5395d6c3e981f704adec706e8462a3a58ea2d4c13bf3adb5b88e958

SHA512
23abc5812b1e75df77a2f462a12c4b3df70f85e326445dfc271a77eab5c86ef54b73834852e55682cae93ab91c2897040022e41b173cb95dd376cc33c0061a92

Download Submit
memory/868-1551-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/892-1221-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/892-1915-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/892-824-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/968-1508-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1292-550-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1292-1140-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1292-107-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1344-1916-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1344-1254-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1344-866-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1508-1675-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1508-902-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1508-514-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1528-1020-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1528-1424-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1528-2066-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1568-977-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1568-1717-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1568-588-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1584-1507-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1584-1099-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1584-2151-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1624-784-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1624-1877-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1624-1179-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1656-1255-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1656-2237-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1660-1466-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1700-1635-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1700-865-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1700-477-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1856-198-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1856-623-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1856-1296-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1864-149-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1864-587-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1864-1178-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1948-1382-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1948-978-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1948-2029-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1968-1298-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1996-247-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1996-660-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1996-1339-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2068-823-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2068-440-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2068-1634-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2072-1341-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2180-19-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2180-1465-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2180-27-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2180-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2180-741-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2180-345-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2180-17-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2192-2236-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2208-1835-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2208-742-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2208-1141-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2216-513-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2216-85-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2216-1056-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2276-1716-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2276-551-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2276-940-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2416-783-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2416-1549-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2416-399-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2420-1180-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2420-2196-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2424-2067-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2424-1057-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2496-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2496-20-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-28-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2496-48-0x0000000000440000-0x000000000051F000-memory.dmp

Filesize
892KB

Download
memory/2496-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2536-702-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2536-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2536-1098-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2596-1340-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2596-1997-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2596-941-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2628-1794-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2628-661-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2644-71-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2644-62-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2644-41-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2644-60-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2716-701-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2716-296-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2716-1423-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2828-476-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2876-1996-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2876-1297-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2876-903-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2948-1550-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2948-1142-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2948-2152-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3008-624-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3008-1019-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3008-1753-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads