Overview

overview

10

Static

static

10

cb9d55237d...18.exe

windows7-x64

10

cb9d55237d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    30/08/2024, 20:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cb9d55237d6ab97f47aae45cda0a39d7_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    cb9d55237d6ab97f47aae45cda0a39d7

  • SHA1

    2429b44d2cf6fc8ab37170342bf75673b3aebe56

  • SHA256

    de4968e22e85319bfc44a326f20643bf66cb8a81d4a54a3fe48386b932fb1102

  • SHA512

    fa65c01af0522223ed788d9a3a0c1acb83bb5db04469e100ca8d3c42093813b2ba8ea472e4bc2943137945d0741885907055d4f95952c32ea0b0b4a4c51e9c78

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZG:0UzeyQMS4DqodCnoe+iitjWwwC

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 50 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb9d55237d6ab97f47aae45cda0a39d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cb9d55237d6ab97f47aae45cda0a39d7_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1284
      • C:\Users\Admin\AppData\Local\Temp\cb9d55237d6ab97f47aae45cda0a39d7_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\cb9d55237d6ab97f47aae45cda0a39d7_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2692
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2580
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1540
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2436
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:840
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2996
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2872
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2400
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:784
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2584
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1308
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2384
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1968
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2072
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2468
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1632
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2364
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2548
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2544
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2056
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2936
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2892
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2428
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3100
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:944
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3296
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3808
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1724
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3384
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2960
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3436
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2736
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3484
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2552
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3512
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2024
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3468
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1776
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3524
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:2512
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1804
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3500
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1812
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3636
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1232
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3544
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2136
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3564
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2536
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3556
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1824
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3604
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1784
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3584
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1056
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3596
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2972
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3572
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2680
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3612
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1096
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3620
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3000
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3644
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2272
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3628
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2096
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:3668
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2884
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3660
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:832
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3684
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:692
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:3652
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2104
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3728
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:948
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3676
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1708
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3736
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3044
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:3696
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2592
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3760
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2080
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3720
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:980
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:3788
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2812
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:3744
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:2864
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:3796
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:2784
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:3704
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:1720
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:3776
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:2740
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:3712
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2492
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:3960
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:516
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:3752
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:628
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3536
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1544
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                PID:2648
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                PID:2620
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                PID:3444
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1272
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:2904
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                PID:3340
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                PID:796
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:2304
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1764
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                PID:1484
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1980
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                PID:3680
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                PID:1772
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1220
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:3112
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:2284
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:3084

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\Parameters.ini
                        Filesize

                        74B

                        MD5

                        6687785d6a31cdf9a5f80acb3abc459b

                        SHA1

                        1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                        SHA256

                        3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                        SHA512

                        5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                        Download Submit

                      • \Windows\system\explorer.exe
                        Filesize

                        2.2MB

                        MD5

                        dcaba5ae2f576c4053ad8988adbf1ce5

                        SHA1

                        fb74209ba605c78c72aff94d21d819ba0031de5c

                        SHA256

                        531c8ad5e16c83f14f926746ff18a69c9df464f72d814a81c6279440611cf533

                        SHA512

                        fded5c0397ce39e8213b8e341891a452d4ceb0bd7e98f44cff43ad54c4331d8a5b44416874b99fdccfd41199ee8147f38555b68dd6bacd0cde81ce9630a4afa8

                        Download Submit

                      • \Windows\system\spoolsv.exe
                        Filesize

                        2.2MB

                        MD5

                        9277116802d89b88e34223e663f084bb

                        SHA1

                        761280b0a9a892f37c46810c76ec7a4da02066cb

                        SHA256

                        7e9128542ee60c58f794f925cd63a908f989cfedb9172b5fbb73a7dfc15affa9

                        SHA512

                        626c9e5bb5faf45b8122e3b53de75656e3fd9c72b49d047f9ea8524ba6ea8cebf069f9addb079ab8dc974e8f014255b8c507c20c5a855a7c9247555b8ed05f79

                        Download Submit

                      • memory/784-891-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/840-2064-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/840-2155-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/944-1395-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1056-1860-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1096-1944-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1232-1707-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1308-981-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1540-616-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1632-2172-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1632-2225-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1724-1396-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1776-1543-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1784-1772-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1804-1625-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1812-1626-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1824-1771-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1968-1072-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2024-1542-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2056-1323-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2072-17-0x00000000001B0000-0x00000000001B1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2072-2137-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2072-28-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2072-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2072-16-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2096-2050-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2136-1708-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2272-2029-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2384-2118-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2400-2079-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2428-1324-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2436-2061-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2436-709-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2468-1151-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2536-1709-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2544-2202-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2548-1232-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2552-1465-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2580-42-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2580-71-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2580-61-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2584-2095-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2680-1943-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2692-25-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2692-19-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2692-50-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2692-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2692-29-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2736-1464-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2872-800-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2936-2240-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2936-2279-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2960-1397-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2972-1866-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3000-2027-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3296-2500-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3384-2391-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3436-2456-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3484-2437-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3500-2457-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3512-2451-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3524-2842-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3536-2487-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3556-2579-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3564-2607-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3584-2613-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3684-2741-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3696-2782-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3712-2722-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3760-2662-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3776-2787-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3960-2790-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download