Overview

overview

10

Static

static

10

d9b132a359...18.exe

windows7-x64

10

d9b132a359...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-09-2024 05:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d9b132a35967eb7fdd40147e84ff2a45_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    d9b132a35967eb7fdd40147e84ff2a45

  • SHA1

    48f1c8e50b87356f80ddca72032f9f05542d2a51

  • SHA256

    5f1930b12fdf8572e0ca2a4627621bdfae299fb8b477dd0e772cc60af6db6c8e

  • SHA512

    749b7683bf4d63811ab02a70cd616f2dadbd1222b45a243dbff81dfc85f282b4f6b4f1e21f2dd2f1c597c41a6f7c7d7b5ec16d835b6487c083e2b1b302c5da14

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwy

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 56 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9b132a35967eb7fdd40147e84ff2a45_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d9b132a35967eb7fdd40147e84ff2a45_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4376
      • C:\Users\Admin\AppData\Local\Temp\d9b132a35967eb7fdd40147e84ff2a45_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d9b132a35967eb7fdd40147e84ff2a45_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3736
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:1484
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:264
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3960
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4372
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1648
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1524
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2256
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3084
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4112
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2412
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2144
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5076
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4568
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4176
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1508
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:920
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:964
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3548
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2340
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1780
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4432
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4984
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2324
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2700
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1972
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3012
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4920
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2224
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:1716
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4312
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3204
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3516
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4828
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:212
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:924
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3476
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2208
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1616
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1676
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4048
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3064
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3776
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3716
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3360
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1880
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1708
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4904
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1308
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4548
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4236
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4360
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2064
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4056
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4728
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3284
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1940
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:216
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:2952
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2032
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:4764
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4008
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2240
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3420
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1184
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3540
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3300
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3496
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:2180
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3024
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:3568
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3320
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2856
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4528
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:3340
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1472
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:744
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3724
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:4024
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:1556
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:1620
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2216
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1324
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Drops file in Windows directory
                        PID:180
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3608
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:4948
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                            PID:1136
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:684
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:5052
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Drops file in Windows directory
                            PID:2868
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2432
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:368
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4656
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:3560
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:1068
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3268
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:1504
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:4816
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:1144
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:8
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:2896
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:2828
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:3564
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4504
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:5036
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:2236
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:3872
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2156
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:3328
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            PID:2380
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4068
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:2704
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4516
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:548
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:2640
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4716
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:1316
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:3028
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Drops file in Windows directory
                            PID:4680
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:2188
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:2232
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:4300
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:4228
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:5116
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:516
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1848
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:1800
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:2152
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:1732
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:816
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2824
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1636
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                      1⤵
                        PID:1152

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Windows\Parameters.ini
                        Filesize

                        74B

                        MD5

                        6687785d6a31cdf9a5f80acb3abc459b

                        SHA1

                        1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                        SHA256

                        3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                        SHA512

                        5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                        Download Submit

                      • C:\Windows\System\explorer.exe
                        Filesize

                        2.2MB

                        MD5

                        6cef1c4d010e56ce5df2dda7c7429de3

                        SHA1

                        f1509916c8f9a991d3edc867b7f58a71f1763989

                        SHA256

                        c590588016eab1420d5f21e691ceb72367339a6a625be8c8d967ebffc6c0d721

                        SHA512

                        be58604d9860b17b9427d59504acf4e6da435e6bd1d9d7bb06d081172325126cc765c9da7efd3398c8c1b87e8f9ecfadc7888953c27a65a1f53c2019bccd72f6

                        Download Submit

                      • C:\Windows\System\spoolsv.exe
                        Filesize

                        2.2MB

                        MD5

                        483247cefd7f84f7094a5aed1a8a0cf1

                        SHA1

                        eb3d2d15ee5b91a0ec8ae07ed5bce1be21d6fea7

                        SHA256

                        9f25439dbe9bed88a1f0a461ae0a175bb51fa4647f5bfc32e0dbeecb8f61fa67

                        SHA512

                        7044e315e69d94ccee5facf1790f2a9b8c18155be2eb3781203dd0cf6184e82ca5c1a1b223a291db49551e6b8012631ce01a05d4ead122b2992c6bc1fc206914

                        Download Submit

                      • memory/212-2252-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/216-2014-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/264-94-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/264-4005-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/264-699-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/368-4419-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/744-4821-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/920-2451-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/920-2167-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/924-1607-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1144-4811-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1144-4955-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1184-2808-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1184-2813-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1308-2466-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1308-2602-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1324-4128-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1324-4006-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1484-95-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1484-89-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1504-4704-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1508-1345-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1524-3343-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1620-5045-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1676-1669-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1716-1593-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1780-2178-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1880-1770-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/1940-4429-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/1972-1475-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2064-2539-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2064-2544-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2144-1248-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2180-2976-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2180-3112-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2188-5245-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2208-1608-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2224-2224-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2240-4622-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2256-1066-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2256-2000-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2324-1418-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2340-1346-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/2412-2007-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2700-2198-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2700-2200-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2828-4888-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2828-4893-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2856-2985-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2856-2990-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/2952-2711-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3012-2208-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3028-5236-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3064-1670-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3084-1997-0x0000000000440000-0x0000000000509000-memory.dmp

                        Filesize

                        804KB

                        Download

                      • memory/3084-1999-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3084-1996-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3204-1594-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3300-2878-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3300-2883-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3328-5116-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3340-3251-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3360-2371-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3476-2262-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3516-2243-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3548-4071-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3560-4743-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3560-4612-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3568-4804-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3716-1722-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3736-39-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3736-83-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3736-40-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3776-2303-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3872-5037-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/3960-786-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/3960-1982-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4024-3332-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4056-1994-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4112-1182-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4112-2009-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4176-2097-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4236-4237-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4312-2235-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4360-1980-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4372-1981-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4372-2150-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4432-1357-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4504-5027-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4568-1314-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4728-2778-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4728-2633-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4764-2945-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4764-2801-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4828-1595-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4904-1837-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4920-1537-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/4948-4226-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/4984-2190-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/5052-4516-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/5076-2021-0x0000000000400000-0x000000000043E000-memory.dmp

                        Filesize

                        248KB

                        Download

                      • memory/5084-44-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/5084-0-0x0000000002470000-0x0000000002471000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/5084-36-0x0000000000400000-0x00000000005D3000-memory.dmp

                        Filesize

                        1.8MB

                        Download

                      • memory/5084-37-0x0000000002470000-0x0000000002471000-memory.dmp

                        Filesize

                        4KB

                        Download