Analysis

  • max time kernel
    145s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 09:02

General

  • Target

    a8dc7c179381f7747b852d48fe42a2dd_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    a8dc7c179381f7747b852d48fe42a2dd

  • SHA1

    6bbaff7a475b687594b11a839cfca4591980de02

  • SHA256

    cff0073217546f9bb235806ebc129c4169ba55a5471d8839816ee1c204336168

  • SHA512

    0c983a8d89bc5971c45ae92af740d18ad95a9a6ed74e4e43cbb1823b02429c79473be5f49301a634ba2a968260708647e943f1e7106a15f686add63039da54e7

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwc

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8dc7c179381f7747b852d48fe42a2dd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a8dc7c179381f7747b852d48fe42a2dd_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1380
      • C:\Users\Admin\AppData\Local\Temp\a8dc7c179381f7747b852d48fe42a2dd_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a8dc7c179381f7747b852d48fe42a2dd_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2780
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2472
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2108
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              PID:2168
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:4764
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:1508
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:4752
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                        PID:4812
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:2016
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:4552
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      PID:1164
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      PID:608
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:5124
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:1524
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:5936
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          PID:2872
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          PID:2476
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:6640
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            PID:2820
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            PID:2936
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:6812
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              PID:320
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              PID:2240
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              PID:1632
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              PID:1728
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:6888
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                PID:2588
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:7044
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:2064
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1924
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:1012
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:6964
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:2264
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:1776
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:7036
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1780
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:572
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:548
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2580
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2788
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2236
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1724
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2004
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2988
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2660
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2948
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:340
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1248
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2412
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2884
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1976
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:3020
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1680
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1424
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:916
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2196
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2456
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1676
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:784
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:324
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:2720
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1956
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:984
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1604
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2728
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2152
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1620
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:3000
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:276
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:772
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:376
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1888
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1416
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2600
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2088
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:980
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      PID:1952
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:1544
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:2360
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:3052
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:2276
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:2696
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:2184
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:2356
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:332
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:2464
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:1932
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Drops file in Windows directory
                                                      PID:2876
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                        PID:2032
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                          PID:1256
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:2628
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:2204
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:3184
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:3336
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                  PID:3496
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                    PID:3688
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    c:\windows\system\spoolsv.exe SE
                                                                    5⤵
                                                                      PID:3888
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:4044
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:3152
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:3332
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:3524
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:3756
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                          • Drops file in Windows directory
                                                                          PID:3940
                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                          c:\windows\system\spoolsv.exe SE
                                                                          5⤵
                                                                            PID:4060
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            PID:3216
                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                            c:\windows\system\spoolsv.exe SE
                                                                            5⤵
                                                                              PID:3432
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                              • Drops file in Windows directory
                                                                              PID:3632
                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                              c:\windows\system\spoolsv.exe SE
                                                                              5⤵
                                                                                PID:3872
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:3092
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                • Drops file in Windows directory
                                                                                PID:3292
                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                c:\windows\system\spoolsv.exe SE
                                                                                5⤵
                                                                                  PID:3536
                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                  5⤵
                                                                                    PID:3812
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                    • Drops file in Windows directory
                                                                                    PID:4052
                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                    5⤵
                                                                                      PID:3196
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:3468
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:3792
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:3676
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:3240
                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                      5⤵
                                                                                        PID:3556
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                        • Drops file in Windows directory
                                                                                        PID:3968
                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                        5⤵
                                                                                          PID:3960
                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                          5⤵
                                                                                            PID:3460
                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                            5⤵
                                                                                              PID:3852
                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                              5⤵
                                                                                                PID:3928
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                • Drops file in Windows directory
                                                                                                PID:3516
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                • Drops file in Windows directory
                                                                                                PID:4004
                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                5⤵
                                                                                                  PID:3320
                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                  5⤵
                                                                                                    PID:3816
                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                    5⤵
                                                                                                      PID:3180
                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                      5⤵
                                                                                                        PID:3704
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:3944
                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                        5⤵
                                                                                                          PID:3840
                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                          5⤵
                                                                                                            PID:3392
                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                            5⤵
                                                                                                              PID:4072
                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                              5⤵
                                                                                                                PID:3664
                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                5⤵
                                                                                                                  PID:3620
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                  5⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:3580
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                  5⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:3452
                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                  5⤵
                                                                                                                    PID:3776
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    5⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    PID:3160
                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                    5⤵
                                                                                                                      PID:3232
                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                      5⤵
                                                                                                                        PID:3228
                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                        5⤵
                                                                                                                          PID:3708
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                          5⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          PID:4196
                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                          5⤵
                                                                                                                            PID:4356
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:4512
                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                            5⤵
                                                                                                                              PID:4672
                                                                                                                            • \??\c:\windows\system\spoolsv.exe
                                                                                                                              c:\windows\system\spoolsv.exe SE
                                                                                                                              5⤵
                                                                                                                                PID:4828
                                                                                                                              • \??\c:\windows\system\spoolsv.exe
                                                                                                                                c:\windows\system\spoolsv.exe SE
                                                                                                                                5⤵
                                                                                                                                  PID:5032
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4152
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4312
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4492
                                                                                                                                • \??\c:\windows\system\spoolsv.exe
                                                                                                                                  c:\windows\system\spoolsv.exe SE
                                                                                                                                  5⤵
                                                                                                                                    PID:4668
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4856
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:5016
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:4184
                                                                                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                                                                                    c:\windows\system\spoolsv.exe SE
                                                                                                                                    5⤵
                                                                                                                                      PID:4412
                                                                                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                                                                                      c:\windows\system\spoolsv.exe SE
                                                                                                                                      5⤵
                                                                                                                                        PID:4608
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4816
                                                                                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                                                                                        c:\windows\system\spoolsv.exe SE
                                                                                                                                        5⤵
                                                                                                                                          PID:5012
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4208
                                                                                                                                        • \??\c:\windows\system\spoolsv.exe
                                                                                                                                          c:\windows\system\spoolsv.exe SE
                                                                                                                                          5⤵
                                                                                                                                            PID:4424
                                                                                                                                          • \??\c:\windows\system\spoolsv.exe
                                                                                                                                            c:\windows\system\spoolsv.exe SE
                                                                                                                                            5⤵
                                                                                                                                              PID:6824

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                    Persistence

                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                    3
                                                                                                                                    T1547

                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                    2
                                                                                                                                    T1547.001

                                                                                                                                    Winlogon Helper DLL

                                                                                                                                    1
                                                                                                                                    T1547.004

                                                                                                                                    Privilege Escalation

                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                    3
                                                                                                                                    T1547

                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                    2
                                                                                                                                    T1547.001

                                                                                                                                    Winlogon Helper DLL

                                                                                                                                    1
                                                                                                                                    T1547.004

                                                                                                                                    Defense Evasion

                                                                                                                                    Modify Registry

                                                                                                                                    4
                                                                                                                                    T1112

                                                                                                                                    Hide Artifacts

                                                                                                                                    1
                                                                                                                                    T1564

                                                                                                                                    Hidden Files and Directories

                                                                                                                                    1
                                                                                                                                    T1564.001

                                                                                                                                    Discovery

                                                                                                                                    System Information Discovery

                                                                                                                                    1
                                                                                                                                    T1082

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\Windows\Parameters.ini
                                                                                                                                      MD5

                                                                                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                      SHA1

                                                                                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                      SHA256

                                                                                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                      SHA512

                                                                                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                    • C:\Windows\Parameters.ini
                                                                                                                                      Filesize

                                                                                                                                      74B

                                                                                                                                      MD5

                                                                                                                                      6687785d6a31cdf9a5f80acb3abc459b

                                                                                                                                      SHA1

                                                                                                                                      1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                                                                                      SHA256

                                                                                                                                      3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                                                                                      SHA512

                                                                                                                                      5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                                                                                    • \Windows\system\explorer.exe
                                                                                                                                      Filesize

                                                                                                                                      2.2MB

                                                                                                                                      MD5

                                                                                                                                      84f5740c74f8b87f72a7ff622e816b39

                                                                                                                                      SHA1

                                                                                                                                      eb2d17d31a018139730a26aeef08706a8c92ea70

                                                                                                                                      SHA256

                                                                                                                                      58ea9c46be2dafbe760abc14d9b5e87b827a2b6e764c57c4daeb3ed817e08403

                                                                                                                                      SHA512

                                                                                                                                      2b3ce1a1665f200b89db868598136dfeb625c82988df1a1a1bfcd6250e27e9efc356d4634c7caa195846360349aba8a48c52c8804714984e149e3816601e0397

                                                                                                                                    • \Windows\system\spoolsv.exe
                                                                                                                                      Filesize

                                                                                                                                      2.2MB

                                                                                                                                      MD5

                                                                                                                                      ee30d0b2f43d8ce2ae40b16be7b43d5e

                                                                                                                                      SHA1

                                                                                                                                      72a0d96df51f6d28012b995086beb0e5186cc289

                                                                                                                                      SHA256

                                                                                                                                      852e0526e28259a22d2b2eea86afe58f40d5e89678124a0a236a77ba9a9f621c

                                                                                                                                      SHA512

                                                                                                                                      ea51e8277a9efba32c1c38dc60d0581ef527178c4c0cd21a449ade08984d20defc04d230813c0a4ce340d6fd5e97ad1726fa0d70e8a9a48b32aa75d7caf1ec5c

                                                                                                                                    • memory/320-2879-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/548-3313-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/572-3309-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/608-2397-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1012-2891-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1164-2396-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1508-2393-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1524-2874-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1632-2881-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1724-3317-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1728-2883-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1776-3305-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1780-3308-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1924-2890-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2004-3318-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2016-2395-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2064-19-0x0000000000320000-0x0000000000321000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2064-2889-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2064-29-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2064-0-0x0000000000320000-0x0000000000321000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2064-17-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2108-2380-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/2168-2381-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2236-3316-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2240-2880-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2264-3304-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2472-42-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2472-71-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2472-61-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2476-2876-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2580-3314-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2588-2888-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2660-3320-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2780-20-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/2780-28-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/2780-50-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/2780-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2780-27-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/2788-3315-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2820-2877-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2872-2875-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2936-2878-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/2988-3319-0x0000000000400000-0x00000000005D3000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/4552-5288-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/4752-5253-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/4764-5264-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/5936-5398-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB

                                                                                                                                    • memory/6640-5432-0x0000000000400000-0x000000000043E000-memory.dmp
                                                                                                                                      Filesize

                                                                                                                                      248KB