Overview

overview

10

Static

static

10

b790fcf7cc...0N.exe

windows7-x64

10

b790fcf7cc...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2024 16:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b790fcf7cccc85347b3928b0a5c1ed30N.exe

  • Size

    2.2MB

  • MD5

    b790fcf7cccc85347b3928b0a5c1ed30

  • SHA1

    7e4df5bcb9d7f9e4ed5745efba8dd7954171a677

  • SHA256

    a3733fba7122b69d6bcbc607ad284992284eac9d9d8d74960ee03a1e315f445f

  • SHA512

    fa700e2e889c7ed8776776e33a645d91652845cc0484257076d7aa3222c899561a364e0904bad1e9e75d0d940aeb8374d722211f0d6c214deaee2116795450e4

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZC:0UzeyQMS4DqodCnoe+iitjWwwe

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 34 IoCs
  • Drops file in Windows directory 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b790fcf7cccc85347b3928b0a5c1ed30N.exe
    "C:\Users\Admin\AppData\Local\Temp\b790fcf7cccc85347b3928b0a5c1ed30N.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3400
      • C:\Users\Admin\AppData\Local\Temp\b790fcf7cccc85347b3928b0a5c1ed30N.exe
        "C:\Users\Admin\AppData\Local\Temp\b790fcf7cccc85347b3928b0a5c1ed30N.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1624
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1556
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:320
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:920
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:708
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2320
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:316
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1948
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4460
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4208
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4496
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1612
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1752
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3580
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:4704
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1992
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2940
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2676
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3856
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:8
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4928
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:1832
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4516
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3764
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2892
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:5072
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4340
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3328
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2568
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2408
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1036
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1868
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1172
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3528
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:4840
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2268
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1636
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1856
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1580
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2340
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4356
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:5096
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3588
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2748
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1032
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4628
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3636
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      PID:4176
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3756
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3576
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3556
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3492
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4644
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3900
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2680
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1572
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1204
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3160
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2400
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1576
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4184
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3692
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2968
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3752
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3848
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3608
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:232
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2912
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2840
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3164
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:3088
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3600
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:2796
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2148
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2312
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:3172
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                              PID:2584
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2532
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2728
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:3380
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          PID:4508
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2508
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:1200
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:2524
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                              PID:3296
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                      1⤵
                        PID:1768

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\Parameters.ini
                        Filesize

                        74B

                        MD5

                        6687785d6a31cdf9a5f80acb3abc459b

                        SHA1

                        1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                        SHA256

                        3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                        SHA512

                        5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                        Download Submit

                      • C:\Windows\System\explorer.exe
                        Filesize

                        2.2MB

                        MD5

                        4f4c30c114162b4629609e7280d7fefd

                        SHA1

                        caf5c60fd0c10cd23a15358c7a483418d1428981

                        SHA256

                        19dac04f81215c8a97ccf928fce2ec6da890c7ca1118d059f321bad78a535b3f

                        SHA512

                        5853e9d54f274816ae21510a5c83bfb235abfd17af83f5ecbf95f821b81942de9da6cf50d453b98eb4f7bc246bc0682845ba175fedcef42c0d055fdccc0cecd5

                        Download Submit

                      • C:\Windows\System\spoolsv.exe
                        Filesize

                        2.2MB

                        MD5

                        5df66377efcc52644ead219517dfbb70

                        SHA1

                        026f7e350fe9e3a7ed26393838ab5eb7937a9d38

                        SHA256

                        dc50aac17f439a280b563c2008671296da6e2a266079f75c58ecbc40281b0be4

                        SHA512

                        41698612d78fecb8f37457df281e5802f5a014b3e0445ad18017dcca4b9e9b9e311ca2f14d3dca47f26f91ef85113e8d161053d9ee2e972669c4f9a2db8228da

                        Download Submit

                      • memory/8-1182-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/232-2907-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/316-3008-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/320-701-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/320-95-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/708-2126-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/708-2018-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/920-2019-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/920-773-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1032-2564-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1032-2568-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1036-1499-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1172-1581-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1556-96-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1556-90-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1572-2748-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1612-954-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1624-79-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1624-46-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1624-45-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1752-2145-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1752-2296-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1832-1243-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1856-1735-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1868-2422-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1948-2033-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1948-840-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1992-1020-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2268-1668-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2340-1797-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2408-2364-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2568-1427-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2676-1106-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2748-1935-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2796-3101-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2796-49-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2796-42-0x00000000007D0000-0x00000000007D1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2796-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2796-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2840-2915-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2892-2340-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2940-2155-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2968-2890-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3088-2927-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3160-2985-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3160-2869-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3172-3204-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3328-2353-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3328-2351-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3492-2717-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3492-2721-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3528-2681-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3556-2043-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3576-2707-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3588-2554-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3588-2556-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3636-2698-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3756-2031-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3764-1299-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3848-2897-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3856-2165-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4184-2877-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4208-903-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4208-2051-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4340-1376-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4356-2545-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4460-2038-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4460-2039-0x0000000000440000-0x0000000000509000-memory.dmp

                        Filesize

                        804KB

                        Download

                      • memory/4496-2049-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4496-2053-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4628-2017-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4644-2138-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4704-3270-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4928-2176-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/5096-1798-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download