Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/04/2024, 03:11

General

  • Target

    024885959930437241cd532dba529335_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    024885959930437241cd532dba529335

  • SHA1

    c22e8f6b1ada57d0a391b466f55b4533f5a99496

  • SHA256

    725001c5379619960cc42fb8e6ca0fd56c9ca61b24d67e8b0126a38e7d76e7cb

  • SHA512

    50d218ce70d8ed900da78e2b74e1628b3db2d1fbc016477d085f7529f03b2a4af8e13d00d86fde4598206720f7fd35d34995e8f9a523fc913a96f65963952595

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZe:0UzeyQMS4DqodCnoe+iitjWwwi

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2636
      • C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\024885959930437241cd532dba529335_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2400
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2420
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2092
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2040
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2552
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2312
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2652
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:1520
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:812
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:652
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1296
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2728
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1752
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1576
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1760
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2096
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2372
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:912
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Drops file in Windows directory
                  PID:2832
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1704
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:1564
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1964
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3288
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2036
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3460
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1824
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3612
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1056
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3628
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2860
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3784
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2384
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3620
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1032
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3880
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1248
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3792
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2140
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:4024
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2208
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3976
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:968
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3080
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2744
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:4080
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2388
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:2320
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1808
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:2712
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2084
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3176
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1920
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:944
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:476
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3464
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2200
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3240
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3012
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:3584
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:588
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:3452
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1284
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:3576
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1372
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3488
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1620
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:3540
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2252
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:3684
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:2768
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:692
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2676
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:3692
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1544
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:3456
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:836
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:3876
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:2892
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:324
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:2364
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:1812
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:1044
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:312
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:1492
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:2120
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:2220
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:2688
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:2524
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:3172
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:2168
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:2648
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Drops file in Windows directory
                                            PID:2992
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:3136
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:760
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:4020
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • Drops file in Windows directory
                                                PID:2448
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:3316
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  PID:1624
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:2856
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • Drops file in Windows directory
                                                    PID:1204
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:3304
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • Drops file in Windows directory
                                                      PID:756
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:3564
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:2080
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:3292
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Drops file in Windows directory
                                                          PID:532
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            "c:\windows\system\spoolsv.exe"
                                                            6⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3968
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:2812
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          PID:1200
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          PID:628
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:3700
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:1660
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:1828
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:3480
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:608
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:1924
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:3788
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:1572
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:1968
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:2972
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:3708
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:2984
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:4016
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:2820
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Drops file in Windows directory
                                                              PID:440
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:2696

                                                      Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Windows\Parameters.ini

                                                              Filesize

                                                              74B

                                                              MD5

                                                              6687785d6a31cdf9a5f80acb3abc459b

                                                              SHA1

                                                              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                              SHA256

                                                              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                              SHA512

                                                              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                            • C:\Windows\System32\spool\drivers\x64\3\mxdwdui.BUD

                                                              Filesize

                                                              56KB

                                                              MD5

                                                              bd72dcf1083b6e22ccbfa0e8e27fb1e0

                                                              SHA1

                                                              3fd23d4f14da768da7b8364d74c54932d704e74e

                                                              SHA256

                                                              90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

                                                              SHA512

                                                              72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

                                                            • \Windows\system\explorer.exe

                                                              Filesize

                                                              2.2MB

                                                              MD5

                                                              9a5dc29010612a0bd3b6d157145ce808

                                                              SHA1

                                                              017bdeb6241cf7b3f55f058df701de6011b05c1f

                                                              SHA256

                                                              02cef7c9eb2ed2c03ae6297634ce53f6556d5bf7eba02c8e749854b20547d337

                                                              SHA512

                                                              db40220fbf97a08170799edfd7aa6177381c15cab0e6d274effd8a8bbe0c0e8aa4c571968f693b54fa6f14d03f5a4c5512749e1ff6179cc64237a62fe00de336

                                                            • \Windows\system\spoolsv.exe

                                                              Filesize

                                                              2.2MB

                                                              MD5

                                                              f06931528e438d70d5fbe37885371d11

                                                              SHA1

                                                              9f8c74718e43a8fd25fa8325befefb74ea1f53b5

                                                              SHA256

                                                              0f7708424123dd05846c05f543bcbc846986995054b73a7b7eb7dc54ab1815b1

                                                              SHA512

                                                              7a6cd6a0fd98041e1506aad79049b19651a64ab220242b55d2dc4b072618ac7d3ca3bd9115b1ac65cf8ec586d4197d6c07d3d2065d7f376332815b086fbf400e

                                                            • memory/324-2730-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/476-2068-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/588-2071-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/652-2235-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/812-1089-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/912-2356-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/944-2550-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/968-1745-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1032-1736-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1056-1539-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1248-1737-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1284-2072-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1296-1090-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1372-2073-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1564-2322-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1576-2290-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1576-2294-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/1704-1531-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1752-1297-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1760-1303-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1808-1871-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1824-1538-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1920-1873-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/1964-1533-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2036-1537-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2040-860-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2084-1872-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2092-859-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2096-2287-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2140-1743-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2200-2069-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2208-1744-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2312-861-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2320-2581-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2372-1304-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2384-1735-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2388-1870-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2400-20-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2400-28-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2400-26-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2400-50-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2400-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2420-42-0x0000000000220000-0x0000000000221000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2420-61-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2420-63-0x0000000000220000-0x0000000000221000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2420-71-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2552-2189-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2648-2842-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2652-2199-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2652-2245-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2728-2211-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/2744-1869-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2768-19-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2768-29-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2768-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2768-17-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/2860-1733-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/3012-2070-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                              Filesize

                                                              1.8MB

                                                            • memory/3172-2796-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3456-2706-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3460-2402-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3464-2647-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3488-2610-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3540-2631-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3576-2643-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3612-2427-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3684-2658-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3692-2670-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3784-2459-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3792-2457-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3880-2472-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/3968-2483-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4020-2793-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB

                                                            • memory/4024-2507-0x0000000000400000-0x000000000043E000-memory.dmp

                                                              Filesize

                                                              248KB