pony | 1315569e0430bd97604cf48d87bca0b4ad9c23ee5846450b47473c18527527e5

General

Target

04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
Size

2.2MB
MD5

04c2e6160622008c9145902c6b7496b6
SHA1

57a8add157bd214812ec2a97181562f53d3f3686
SHA256

1315569e0430bd97604cf48d87bca0b4ad9c23ee5846450b47473c18527527e5
SHA512

c08256c1a8752b75fd65cc8a229322894cb544564094de4e5659bcfc0587c6731d517c254499fd78539cae22b4dc0873086a5dffeb4258aa6f8408e6b7e7735c
SSDEEP

24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZk:0UzeyQMS4DqodCnoe+iitjWwwg

Score

10^/10

pony evasion persistence rat spyware stealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes

payload_url
http://don.service-master.eu/shit.exe

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

Drops startup file 2 IoCs

Processes:

04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe

Executes dropped EXE 28 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exe

pid	process
4456	explorer.exe
1436	explorer.exe
4032	spoolsv.exe
4152	spoolsv.exe
1552	spoolsv.exe
3136	spoolsv.exe
2308	spoolsv.exe
1680	spoolsv.exe
1032	spoolsv.exe
5032	spoolsv.exe
4332	spoolsv.exe
1512	spoolsv.exe
1156	spoolsv.exe
2376	spoolsv.exe
4192	spoolsv.exe
4364	explorer.exe
4792	spoolsv.exe
4396	spoolsv.exe
724	spoolsv.exe
3544	spoolsv.exe
4232	explorer.exe
2196	spoolsv.exe
4924	spoolsv.exe
4984	spoolsv.exe
940	explorer.exe
1196	spoolsv.exe
3320	spoolsv.exe
4240	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 4836 set thread context of 1860	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
PID 4456 set thread context of 1436	4456	explorer.exe	explorer.exe
PID 4032 set thread context of 4192	4032	spoolsv.exe	spoolsv.exe
PID 4152 set thread context of 4396	4152	spoolsv.exe	spoolsv.exe
PID 1552 set thread context of 3544	1552	spoolsv.exe	spoolsv.exe
PID 3136 set thread context of 2196	3136	spoolsv.exe	spoolsv.exe
PID 1680 set thread context of 3320	1680	spoolsv.exe	spoolsv.exe

Drops file in Windows directory 22 IoCs

Processes:

explorer.exe04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exe04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	explorer.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe
File opened for modification	C:\Windows\Parameters.ini	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exeexplorer.exe

pid	process
1860	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
1860	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exe

pid	process
1860	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
1860	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
1436	explorer.exe
4192	spoolsv.exe
4192	spoolsv.exe
4396	spoolsv.exe
4396	spoolsv.exe
3544	spoolsv.exe
3544	spoolsv.exe
2196	spoolsv.exe
2196	spoolsv.exe
4984	spoolsv.exe
4984	spoolsv.exe
3320	spoolsv.exe
3320	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 4836 wrote to memory of 1708	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	splwow64.exe
PID 4836 wrote to memory of 1708	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	splwow64.exe
PID 4836 wrote to memory of 1860	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
PID 4836 wrote to memory of 1860	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
PID 4836 wrote to memory of 1860	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
PID 4836 wrote to memory of 1860	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
PID 4836 wrote to memory of 1860	4836	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
PID 1860 wrote to memory of 4456	1860	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	explorer.exe
PID 1860 wrote to memory of 4456	1860	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	explorer.exe
PID 1860 wrote to memory of 4456	1860	04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe	explorer.exe
PID 4456 wrote to memory of 1436	4456	explorer.exe	explorer.exe
PID 4456 wrote to memory of 1436	4456	explorer.exe	explorer.exe
PID 4456 wrote to memory of 1436	4456	explorer.exe	explorer.exe
PID 4456 wrote to memory of 1436	4456	explorer.exe	explorer.exe
PID 4456 wrote to memory of 1436	4456	explorer.exe	explorer.exe
PID 1436 wrote to memory of 4032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4152	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4152	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4152	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1552	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1552	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1552	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 3136	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 3136	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 3136	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 2308	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 2308	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 2308	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1680	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1680	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1680	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 5032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 5032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 5032	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4332	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4332	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4332	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1512	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1512	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1512	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1156	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1156	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 1156	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 2376	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 2376	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 2376	1436	explorer.exe	spoolsv.exe
PID 4032 wrote to memory of 4192	4032	spoolsv.exe	spoolsv.exe
PID 4032 wrote to memory of 4192	4032	spoolsv.exe	spoolsv.exe
PID 4032 wrote to memory of 4192	4032	spoolsv.exe	spoolsv.exe
PID 4032 wrote to memory of 4192	4032	spoolsv.exe	spoolsv.exe
PID 4032 wrote to memory of 4192	4032	spoolsv.exe	spoolsv.exe
PID 4192 wrote to memory of 4364	4192	spoolsv.exe	explorer.exe
PID 4192 wrote to memory of 4364	4192	spoolsv.exe	explorer.exe
PID 4192 wrote to memory of 4364	4192	spoolsv.exe	explorer.exe
PID 1436 wrote to memory of 4792	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4792	1436	explorer.exe	spoolsv.exe
PID 1436 wrote to memory of 4792	1436	explorer.exe	spoolsv.exe
PID 4152 wrote to memory of 4396	4152	spoolsv.exe	spoolsv.exe
PID 4152 wrote to memory of 4396	4152	spoolsv.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04c2e6160622008c9145902c6b7496b6_JaffaCakes118.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4456

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4032

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4364

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:8

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4152

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4396

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1552

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3544

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:3892

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3136

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2196

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:2308

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4984

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:940

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:2404

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1680

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3320

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
- Executes dropped EXE
PID:4240

\??\c:\windows\system\explorer.exe
"c:\windows\system\explorer.exe"
8⤵
PID:3000

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1032

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4012

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5032

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2808

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:1548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4332

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1296

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1512

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4872

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:2548

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1156

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:732

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:2960

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2376

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3044

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:972

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4792

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:4372

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:1072

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:724

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:1652

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:4408

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4924

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3156

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:1976

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:1196

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:2168

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4628

\??\c:\windows\system\spoolsv.exe
"c:\windows\system\spoolsv.exe"
6⤵
PID:3888

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
7⤵
PID:4944

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3588

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2076

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1180

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3100

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3644

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1028

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:684

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:1284

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:4004

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:3844

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:2096

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:5044

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
PID:396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Parameters.ini
Filesize
74B

MD5
6687785d6a31cdf9a5f80acb3abc459b

SHA1
1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

SHA256
3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

SHA512
5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

Download Submit
C:\Windows\System\explorer.exe
Filesize
2.2MB

MD5
f229c3fadfe775f3555042fc06abec4c

SHA1
68869f2f5b232ff839f206474dcf4d0761567b0c

SHA256
49989d7056b1429ef9939a50da91abefad31603a9841afbe22c68f69ec09eb7b

SHA512
c311aa612e88779be83bdc5f082d97dc704550bee5ecac683b55172be2c029548f0cc2468330da0b10d9e5fa90de4a45f0c6c35e216645e0355c97653a5093c1

Download Submit
C:\Windows\System\spoolsv.exe
Filesize
2.2MB

MD5
8a8fe59822bbd3276bb9c882290c2747

SHA1
3fb25aafbc9c4f7d97ae1babe4f502633dd5f89c

SHA256
e49c5960f413619ba8fc04f972277c8d4d69623ae833e2a7f2e3177a897f927b

SHA512
fdbe7a0f293cebcf51aa9ba62409b11334e8095adc9e3e1bac3a0c8d10f1a7655b39fc57aa95377e716b6f5177c09b119b6003fb3afbb820e3a9320c481596b1

Download Submit
memory/8-2196-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/732-1901-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/732-2024-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1032-631-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1156-948-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1296-1555-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1436-77-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1436-193-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1512-808-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1552-389-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1552-945-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1652-2488-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1652-2384-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1680-574-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/1860-70-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-68-0x0000000000440000-0x0000000000509000-memory.dmp

Filesize
804KB

Download
memory/1860-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1860-15-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2196-962-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2308-1102-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2308-500-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2376-1098-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/2404-2553-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-1485-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2808-1613-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3000-2719-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3044-2182-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3044-2045-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3136-959-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3136-450-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/3156-2684-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3320-1420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3320-1261-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-949-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3544-1096-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3892-2436-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4012-1336-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4032-251-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4032-714-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4152-340-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4152-806-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4192-874-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4192-739-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4332-717-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4372-2315-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4396-809-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4396-813-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4456-78-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4456-71-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4836-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4836-20-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4836-13-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4836-11-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download
memory/4872-1832-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-1689-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4984-1250-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5032-716-0x0000000000400000-0x00000000005D3000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads