Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 16:38

General

  • Target

    a15ce283e4a19cd8f7e1070881ee8c4a_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    a15ce283e4a19cd8f7e1070881ee8c4a

  • SHA1

    dc0bde9abf0180c3944d8fa94a9a7532ada29969

  • SHA256

    b34b31ec4a535000f5fe1684693801314f342c291f029707a711080fe275117b

  • SHA512

    e2e999b3b32feaa1f30c47c8305340a5a5c3c2afca395e04c4e873a01ee793ecb89c2315d23be1578771bdd68248bb57a4b7f690c54a9bf840a820732c5bd019

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ0:0UzeyQMS4DqodCnoe+iitjWwwA

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 56 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a15ce283e4a19cd8f7e1070881ee8c4a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a15ce283e4a19cd8f7e1070881ee8c4a_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:600
      • C:\Users\Admin\AppData\Local\Temp\a15ce283e4a19cd8f7e1070881ee8c4a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a15ce283e4a19cd8f7e1070881ee8c4a_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1040
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3212
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4360
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2284
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4332
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3812
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1076
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1448
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2128
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4304
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3132
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1820
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3860
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4580
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5032
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3980
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1960
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4908
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:1104
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4608
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4380
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4536
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1804
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3036
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3868
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3232
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4748
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3416
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4852
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3472
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:4736
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1720
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3960
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4732
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4956
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:5048
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4284
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3084
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3596
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4616
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4420
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4492
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:4636
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:2564
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2480
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4980
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2076
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:1956
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4984
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3208
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4556
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1748
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:1504
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3556
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:556
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:764
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1888
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2948
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:3772
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1436
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:1928
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4916
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:1148
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:552
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:880
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            PID:776
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:5028
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4424
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2476
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:772
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:712
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:5012
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:1976
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1308
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:1612
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:4464
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                    PID:4960
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:2548
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:4500
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Suspicious use of SetThreadContext
                                    PID:1524
                                    • \??\c:\windows\system\explorer.exe
                                      "c:\windows\system\explorer.exe"
                                      8⤵
                                        PID:4508
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:2836
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:2396
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Suspicious use of SetThreadContext
                                        PID:2084
                                        • \??\c:\windows\system\explorer.exe
                                          "c:\windows\system\explorer.exe"
                                          8⤵
                                            PID:4704
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:964
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:4232
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            7⤵
                                            • Drops file in Windows directory
                                            PID:4404
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:1384
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:2136
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                              • Drops file in Windows directory
                                              PID:4388
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:4896
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:4532
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                  PID:1552
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              PID:3896
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:3584
                                                  • \??\c:\windows\system\explorer.exe
                                                    c:\windows\system\explorer.exe
                                                    7⤵
                                                    • Drops file in Windows directory
                                                    PID:1708
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Suspicious use of SetThreadContext
                                                • Drops file in Windows directory
                                                PID:2200
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:544
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  PID:8
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:4660
                                                      • \??\c:\windows\system\explorer.exe
                                                        c:\windows\system\explorer.exe
                                                        7⤵
                                                        • Drops file in Windows directory
                                                        PID:4400
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Drops file in Windows directory
                                                    PID:3460
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      "c:\windows\system\spoolsv.exe"
                                                      6⤵
                                                        PID:4340
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Drops file in Windows directory
                                                      PID:1676
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:4384
                                                          • \??\c:\windows\system\explorer.exe
                                                            c:\windows\system\explorer.exe
                                                            7⤵
                                                            • Drops file in Windows directory
                                                            PID:4628
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Suspicious use of SetThreadContext
                                                        PID:2460
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:4048
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Drops file in Windows directory
                                                          PID:4228
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            "c:\windows\system\spoolsv.exe"
                                                            6⤵
                                                              PID:1292
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Drops file in Windows directory
                                                            PID:1560
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:1692
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Drops file in Windows directory
                                                              PID:3116
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:3376
                                                                  • \??\c:\windows\system\explorer.exe
                                                                    c:\windows\system\explorer.exe
                                                                    7⤵
                                                                      PID:2092
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  • Drops file in Windows directory
                                                                  PID:212
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    "c:\windows\system\spoolsv.exe"
                                                                    6⤵
                                                                      PID:4796
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                    • Drops file in Windows directory
                                                                    PID:1216
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      "c:\windows\system\spoolsv.exe"
                                                                      6⤵
                                                                        PID:4948
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:716
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:492
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:5040
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:2216
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:2680
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:2056
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:4076
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:4476
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:3696
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:4776
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:1340
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:3228
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:2504
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:3768
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                    1⤵
                                                                      PID:1052

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Windows\Parameters.ini

                                                                      Filesize

                                                                      74B

                                                                      MD5

                                                                      6687785d6a31cdf9a5f80acb3abc459b

                                                                      SHA1

                                                                      1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                      SHA256

                                                                      3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                      SHA512

                                                                      5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                    • C:\Windows\Parameters.ini

                                                                      MD5

                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                      SHA1

                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                      SHA256

                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                      SHA512

                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                    • C:\Windows\System\explorer.exe

                                                                      Filesize

                                                                      2.2MB

                                                                      MD5

                                                                      3d5f328010bca7117fa57edc608c46c5

                                                                      SHA1

                                                                      b1136a53dd72f66459a4a312b116912036b29d5a

                                                                      SHA256

                                                                      af070a265e829c0a85d591a798c847938c846c670faccc75c8377724c8027e13

                                                                      SHA512

                                                                      518a7baa35e6bd176c3b30acbe4074023e25636e287e9416840ec071b8928e9e87f81cb1eff39caa2ffa796354ee25291390dd8109c7abb85eebde16a7b3454e

                                                                    • \??\c:\windows\system\spoolsv.exe

                                                                      Filesize

                                                                      2.2MB

                                                                      MD5

                                                                      6be81e994274bd4c72303750eb0dc305

                                                                      SHA1

                                                                      2ec1ecaa42e4531d8e54e3ce51694fc48d121869

                                                                      SHA256

                                                                      47dc7408d11a18499788259dba66bf6902165b8ec351e65fbb5facd20414270d

                                                                      SHA512

                                                                      8047d07cfe7449f7a3be3e26e707526365ebe96324de5844b19f85b4282c2a2041981923b4ecfcbfb19ba91e619c7eadeec765acb59f4dff1d0d679a5884d1bd

                                                                    • memory/544-4736-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/556-2752-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/712-2982-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/764-2033-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/880-2964-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1040-77-0x0000000000440000-0x0000000000509000-memory.dmp

                                                                      Filesize

                                                                      804KB

                                                                    • memory/1040-79-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1040-41-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1040-39-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1076-3352-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1104-3656-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1148-2887-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1292-5123-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1448-862-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/1448-1980-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/1504-4528-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1612-3180-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1612-3282-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1720-1519-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/1804-2177-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1820-999-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/1888-2760-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1888-2764-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1928-2867-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1956-1958-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/1960-2288-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1960-2123-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/1976-3057-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2076-2593-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2128-36-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/2128-0-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/2128-38-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/2128-1985-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2128-42-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/2136-4241-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2136-4102-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2284-1955-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/2284-861-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/2396-3833-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2396-3730-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2476-2972-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2480-2578-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2480-2583-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/2564-1863-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3036-1329-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3084-1679-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3132-2032-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/3208-1959-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3212-85-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3212-91-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3232-1517-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3376-5300-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/3416-1518-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3556-1984-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/3584-4717-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/3772-2772-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/3860-2044-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/3860-2042-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/3868-2219-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/3980-1171-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4048-5112-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4232-4021-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4232-3913-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4284-2414-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4304-998-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4304-2034-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4332-1960-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4332-2104-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4340-4884-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4360-860-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4360-90-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4380-2131-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4384-5029-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4384-5210-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4420-2707-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4420-2526-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4500-3581-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4500-3463-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4508-5134-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4532-4454-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4536-1323-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4556-2744-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4556-2948-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4580-1170-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4608-1172-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4616-1862-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4636-4108-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4660-4865-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4660-5007-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4704-5320-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4732-1677-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4736-3907-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4748-2229-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4852-2296-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4948-5329-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4956-2403-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/4980-1864-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4984-2603-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/5028-4727-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/5032-2052-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/5032-2057-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                      Filesize

                                                                      248KB

                                                                    • memory/5048-1678-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                      Filesize

                                                                      1.8MB