Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 16:45

General

  • Target

    c128d1af016f48a1c3e038b3915395cb_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    c128d1af016f48a1c3e038b3915395cb

  • SHA1

    afd9c701dd19afbc3ecf614a33a818311cf70049

  • SHA256

    2b6deb385b21caa683b43d38a61bbbc950f50053213780550cc43751b0cc3b34

  • SHA512

    4278fc268e252e496683e9bae58e7f96d942a2f28732ea56df30e1ac0b2e6e377c6c27a8431b1ce5c6b43f684cb02f191c8a5b9997173f86058b6bac557b1b28

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwQ

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 46 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c128d1af016f48a1c3e038b3915395cb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c128d1af016f48a1c3e038b3915395cb_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:392
      • C:\Users\Admin\AppData\Local\Temp\c128d1af016f48a1c3e038b3915395cb_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\c128d1af016f48a1c3e038b3915395cb_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1268
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:548
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2656
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3140
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2120
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1564
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4160
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4080
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4496
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1352
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1812
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2872
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:388
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4232
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3652
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1292
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1544
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2336
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:4808
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1820
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1648
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:3460
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1524
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:552
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4224
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:912
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4040
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3448
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3620
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2716
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1348
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:1696
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:5436
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4492
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3868
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4108
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4272
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1032
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1176
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1676
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2920
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4328
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4736
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3528
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:5740
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:800
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3500
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1364
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:704
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1528
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3556
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:4568
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1036
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:4060
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2332
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4588
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3620
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2312
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4424
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1784
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4392
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2944
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3972
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1452
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2936
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3676
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:5892
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1636
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3920
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2868
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3896
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3180
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4432
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:60
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:3116
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:3144
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:5748
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2504
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:4052
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2972
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:5724
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4220
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:1412
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                PID:4812
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:4724
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:5496
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                    PID:5556
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1476
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5344
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:5448
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:3360
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:5692
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:5756
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:5104
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:512
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                          PID:5956
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      PID:2104
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:6064
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:1044
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:6132
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:2284
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:4396
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Drops file in Windows directory
                                        PID:952
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:3788
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:2528
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:5224
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            PID:4600
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:4436
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                    PID:5920
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:3612
                                                • \??\c:\windows\system\spoolsv.exe
                                                  "c:\windows\system\spoolsv.exe"
                                                  6⤵
                                                    PID:6084
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4552
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    "c:\windows\system\spoolsv.exe"
                                                    6⤵
                                                      PID:2384
                                                      • \??\c:\windows\system\explorer.exe
                                                        c:\windows\system\explorer.exe
                                                        7⤵
                                                          PID:2316
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2080
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        "c:\windows\system\spoolsv.exe"
                                                        6⤵
                                                          PID:548
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3740
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                        • Drops file in Windows directory
                                                        PID:3652
                                                      • \??\c:\windows\system\spoolsv.exe
                                                        c:\windows\system\spoolsv.exe SE
                                                        5⤵
                                                          PID:3608
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:764
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5192
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:5812
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          PID:1560
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5840
                                                        • \??\c:\windows\system\spoolsv.exe
                                                          c:\windows\system\spoolsv.exe SE
                                                          5⤵
                                                            PID:4356
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3280
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            PID:6012
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            PID:6092
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5464
                                                          • \??\c:\windows\system\spoolsv.exe
                                                            c:\windows\system\spoolsv.exe SE
                                                            5⤵
                                                              PID:5772
                                                            • \??\c:\windows\system\spoolsv.exe
                                                              c:\windows\system\spoolsv.exe SE
                                                              5⤵
                                                                PID:964
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                        1⤵
                                                          PID:4792

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Windows\Parameters.ini

                                                          Filesize

                                                          74B

                                                          MD5

                                                          6687785d6a31cdf9a5f80acb3abc459b

                                                          SHA1

                                                          1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                                          SHA256

                                                          3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                                          SHA512

                                                          5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                                        • C:\Windows\System\explorer.exe

                                                          Filesize

                                                          2.2MB

                                                          MD5

                                                          d510573d4efc984cb35217e4e32a1dc0

                                                          SHA1

                                                          c5787c2b6c03493a8ac4b99c90de0d7da20af518

                                                          SHA256

                                                          c50debd69abd197dedbfbfdd09d1a245ce5f57ac56c05d3aadfa3c811a49285d

                                                          SHA512

                                                          16ab59b1a513edb75817a1419cd9103421cc09de3ac56df061912776ce19278b9d55dfe53a1fbcb2326e8a5e2c73eab204ed4544294f1f83e8783be78ea93480

                                                        • C:\Windows\System\spoolsv.exe

                                                          Filesize

                                                          2.2MB

                                                          MD5

                                                          098d14a6f724cb0514e53a922971eea2

                                                          SHA1

                                                          389fe503d7551fbc18a8bbb2f5af4f78e859b87b

                                                          SHA256

                                                          840a555f0b895b8db3400816636bf547e070a1ca468703bc41d227676138180a

                                                          SHA512

                                                          e623617ed780f2e9ed722e44be70c3bb596efb5247c0634de12dea7780dd136d6ab3f777b8909cd9f13af601b3e776621fe7e4a262c3cedc9f95e7dd76f0ec29

                                                        • memory/388-2076-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/512-5015-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/512-4854-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/548-99-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/548-5205-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/548-93-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/552-1382-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/704-2629-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/800-1934-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/912-1465-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1032-1703-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1036-2903-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1036-2796-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1176-2460-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1268-55-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1268-54-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1268-82-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1292-1149-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1348-2361-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1348-2523-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1352-976-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1352-2070-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1364-1956-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1412-3932-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1524-2185-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1528-1960-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1544-2333-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1544-2165-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1648-2173-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1648-2176-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1676-1765-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/1812-2069-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/1820-1215-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2120-2147-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/2120-1957-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/2312-2068-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2332-4589-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/2656-4166-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/2656-98-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/2656-733-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/2716-1527-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2872-1042-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2872-2077-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2920-52-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2920-51-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2920-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2920-59-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2936-3059-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3116-3225-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3116-3344-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3140-869-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/3140-1958-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/3448-1526-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/3460-1291-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/3500-2620-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3556-2638-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3620-2286-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3620-2290-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3652-2097-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3788-4907-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3788-4903-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3868-2440-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3896-2994-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3972-2896-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/3972-2910-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4052-3756-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4080-925-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4080-1972-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4108-1636-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4160-3438-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4224-2198-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4224-2193-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4232-1093-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4328-1832-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4392-2824-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4424-2815-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4432-3016-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4432-3012-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4436-5022-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4436-5115-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4492-1584-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4496-1968-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4496-1969-0x0000000000440000-0x0000000000509000-memory.dmp

                                                          Filesize

                                                          804KB

                                                        • memory/4496-1971-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4568-1961-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4588-2060-0x0000000000400000-0x00000000005D3000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/4736-2609-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4736-2723-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/4808-3832-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5344-4352-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5344-4506-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5436-4162-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5496-4263-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5692-4710-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5692-4596-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5724-5197-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5740-4413-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/5892-4861-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/6064-4869-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/6084-5045-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB

                                                        • memory/6132-4879-0x0000000000400000-0x000000000043E000-memory.dmp

                                                          Filesize

                                                          248KB