Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 16:07

General

  • Target

    b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    b4636b1343e40f8211c521b2ef1fe2eb

  • SHA1

    21adaa07ec36ec6fa40aed7eaf394bc27b919d5f

  • SHA256

    606230928ba3855f8dd214943123bc1071778b033a3ad4b158f41a122ef80414

  • SHA512

    7ca016eaea7c0376cc2931928f44f259d54628d9f6af639386b378fd952e0e186b393765f5a106fee04eaf7382becaf08587d64e0a8f2adc8de7b0927981a89d

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZQ:0UzeyQMS4DqodCnoe+iitjWwwk

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 56 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1412
      • C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\b4636b1343e40f8211c521b2ef1fe2eb_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1596
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3764
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3144
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:512
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3512
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:740
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4788
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:464
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5052
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1268
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4768
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2304
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1436
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3320
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4580
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4024
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2216
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1716
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:5112
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2912
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3872
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4952
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3352
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4408
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3600
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4656
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3972
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1928
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3792
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3152
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1204
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3628
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:2224
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2552
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:756
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1512
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4600
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1160
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4388
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3756
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:5080
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2068
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:3472
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:2660
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4792
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4268
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2564
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1708
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1776
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3188
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1072
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2680
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:4584
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:3336
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:956
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4308
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1232
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1004
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4936
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:4292
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:2236
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2568
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:908
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:928
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:2804
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:396
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:768
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:1240
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:432
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:2040
                              • \??\c:\windows\system\explorer.exe
                                "c:\windows\system\explorer.exe"
                                8⤵
                                  PID:2104
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:4092
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:4468
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:4164
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:5076
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:1644
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:2528
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Suspicious use of SetThreadContext
                                  PID:116
                                  • \??\c:\windows\system\explorer.exe
                                    "c:\windows\system\explorer.exe"
                                    8⤵
                                      PID:3676
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:3984
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:4396
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:1736
                                      • \??\c:\windows\system\explorer.exe
                                        "c:\windows\system\explorer.exe"
                                        8⤵
                                          PID:1508
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:4840
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:4780
                                        • \??\c:\windows\system\explorer.exe
                                          c:\windows\system\explorer.exe
                                          7⤵
                                          • Drops file in Windows directory
                                          PID:4608
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:1432
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:1312
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            7⤵
                                              PID:4520
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:4772
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:404
                                              • \??\c:\windows\system\explorer.exe
                                                c:\windows\system\explorer.exe
                                                7⤵
                                                • Drops file in Windows directory
                                                PID:3544
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Suspicious use of SetThreadContext
                                            • Drops file in Windows directory
                                            PID:3172
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:2372
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                  • Drops file in Windows directory
                                                  PID:2088
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • Suspicious use of SetThreadContext
                                              • Drops file in Windows directory
                                              PID:264
                                              • \??\c:\windows\system\spoolsv.exe
                                                "c:\windows\system\spoolsv.exe"
                                                6⤵
                                                  PID:2676
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Suspicious use of SetThreadContext
                                                PID:3180
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:976
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Drops file in Windows directory
                                                  PID:1748
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:2324
                                                      • \??\c:\windows\system\explorer.exe
                                                        c:\windows\system\explorer.exe
                                                        7⤵
                                                          PID:632
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Drops file in Windows directory
                                                      PID:3020
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:3216
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Drops file in Windows directory
                                                        PID:1752
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          "c:\windows\system\spoolsv.exe"
                                                          6⤵
                                                            PID:2904
                                                            • \??\c:\windows\system\explorer.exe
                                                              c:\windows\system\explorer.exe
                                                              7⤵
                                                              • Drops file in Windows directory
                                                              PID:4464
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Drops file in Windows directory
                                                          PID:3228
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            "c:\windows\system\spoolsv.exe"
                                                            6⤵
                                                              PID:4168
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Drops file in Windows directory
                                                            PID:3208
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              "c:\windows\system\spoolsv.exe"
                                                              6⤵
                                                                PID:412
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Drops file in Windows directory
                                                              PID:224
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                "c:\windows\system\spoolsv.exe"
                                                                6⤵
                                                                  PID:4480
                                                                  • \??\c:\windows\system\explorer.exe
                                                                    c:\windows\system\explorer.exe
                                                                    7⤵
                                                                    • Drops file in Windows directory
                                                                    PID:3832
                                                              • \??\c:\windows\system\spoolsv.exe
                                                                c:\windows\system\spoolsv.exe SE
                                                                5⤵
                                                                • Suspicious use of SetThreadContext
                                                                • Drops file in Windows directory
                                                                PID:4376
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  "c:\windows\system\spoolsv.exe"
                                                                  6⤵
                                                                    PID:320
                                                                • \??\c:\windows\system\spoolsv.exe
                                                                  c:\windows\system\spoolsv.exe SE
                                                                  5⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  • Drops file in Windows directory
                                                                  PID:4548
                                                                  • \??\c:\windows\system\spoolsv.exe
                                                                    "c:\windows\system\spoolsv.exe"
                                                                    6⤵
                                                                      PID:212
                                                                      • \??\c:\windows\system\explorer.exe
                                                                        c:\windows\system\explorer.exe
                                                                        7⤵
                                                                          PID:3248
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:3768
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:4300
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:1592
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:4732
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:2364
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                      • Drops file in Windows directory
                                                                      PID:4444
                                                                    • \??\c:\windows\system\spoolsv.exe
                                                                      c:\windows\system\spoolsv.exe SE
                                                                      5⤵
                                                                        PID:552
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:2296
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:4684
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:3548
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:3936
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:3492
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                        • Drops file in Windows directory
                                                                        PID:4616
                                                                      • \??\c:\windows\system\spoolsv.exe
                                                                        c:\windows\system\spoolsv.exe SE
                                                                        5⤵
                                                                          PID:3616
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                  1⤵
                                                                    PID:1880

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Windows\Parameters.ini

                                                                    Filesize

                                                                    74B

                                                                    MD5

                                                                    6687785d6a31cdf9a5f80acb3abc459b

                                                                    SHA1

                                                                    1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                                    SHA256

                                                                    3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                                    SHA512

                                                                    5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                                  • C:\Windows\System\explorer.exe

                                                                    Filesize

                                                                    2.2MB

                                                                    MD5

                                                                    544e840de107b74b73a0c0fef47ef367

                                                                    SHA1

                                                                    b7c33bcb6a9c2eede30698fc0c032a9fc1e652cf

                                                                    SHA256

                                                                    5f804f6c10b313c7faa3ebac14b89182570d38a14137b3130496cbf23ce54d1a

                                                                    SHA512

                                                                    3ea92725374a04dd1897375480cb026db3a8f67a41f48d7d7232c520ffb713c5d4325d86f89c5bb976ab0a7ea525308ed2bb254c0af5fa785025f2d0dc07416b

                                                                  • C:\Windows\System\spoolsv.exe

                                                                    Filesize

                                                                    2.2MB

                                                                    MD5

                                                                    6ef23bcfbc6617c696f443f1de71e50f

                                                                    SHA1

                                                                    587d2447ec39d18e24d9930a2840c2585e3f5699

                                                                    SHA256

                                                                    9696c1037384291484c260cf3c90411bcd1f0a2aacadc846f1e26561636082d2

                                                                    SHA512

                                                                    be8897f7b7da27bf7f0e2850209c35a8e2768da24c39ae84e93e801c70c67b16ba6dd8efdf2fca2e838b29aceca126a64acee439ef6287da1e8d97abd4608068

                                                                  • memory/320-5087-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/404-4208-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/404-4336-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/412-4937-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/412-4940-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/432-3157-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/432-2994-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/464-1933-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/464-983-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/512-1923-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/512-809-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/756-2320-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/768-2872-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/908-2852-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/956-2695-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1004-1952-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1072-2686-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1072-2765-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1160-1656-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1204-2310-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1204-2453-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1232-2707-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1240-23-0x00000000008A0000-0x00000000008A1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1240-28-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1240-0-0x00000000008A0000-0x00000000008A1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1240-21-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1268-984-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1268-1945-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1312-4111-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1312-4002-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1436-1956-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1436-1954-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1508-5099-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1512-1655-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1596-63-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1596-24-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1596-27-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1708-1918-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1776-2553-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/1928-1484-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/2104-4605-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2216-2292-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2216-2130-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2224-3861-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2236-4407-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2304-985-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/2324-4700-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2324-4825-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2372-4493-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2372-4682-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2528-3371-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2552-1654-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/2564-2534-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2660-1835-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/2676-4572-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2676-4532-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2804-2860-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2804-2864-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2904-5053-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2904-4909-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/2912-1158-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3144-808-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3144-78-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3152-1485-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3188-1920-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3216-4710-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3320-1156-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3336-1929-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3352-2151-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3472-3993-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3512-1921-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3512-2101-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3600-2161-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3676-4920-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3756-1834-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3764-79-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3764-74-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/3872-2139-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/3972-2191-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4024-1157-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/4268-1836-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/4308-1943-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/4388-2492-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4396-3649-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4408-1340-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/4468-3015-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4480-5079-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4480-5166-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4580-2040-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4584-4199-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4600-2329-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4656-1483-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/4768-1944-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4780-3842-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4780-3929-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4788-3380-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4792-2522-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4936-2784-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/4952-1329-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/5052-1931-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/5052-1932-0x0000000000440000-0x0000000000509000-memory.dmp

                                                                    Filesize

                                                                    804KB

                                                                  • memory/5052-1935-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/5076-3101-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/5076-3104-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/5080-2600-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/5080-2512-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB

                                                                  • memory/5112-3720-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                    Filesize

                                                                    248KB