Overview

overview

10

Static

static

10

e4e055cbf0...18.exe

windows7-x64

10

e4e055cbf0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 13:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4e055cbf0f9ae7d5102b622aa6ff851_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    e4e055cbf0f9ae7d5102b622aa6ff851

  • SHA1

    7c32e6a26d0683519370da15b48b3ce5c50527c7

  • SHA256

    7334eff28ff1c3b5aa393bdc6857b558062b632c3eea09e92b2673a7b0d46568

  • SHA512

    95d7e19021910a80fc605d992ae19bce52ac6c81be3cccbb9e63b338d41f295f743e59471b94f08ad7de0f1e0587182dcda233133f379f4cd37a9d1fd5317b35

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZS:0UzeyQMS4DqodCnoe+iitjWww2

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 53 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4e055cbf0f9ae7d5102b622aa6ff851_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e4e055cbf0f9ae7d5102b622aa6ff851_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2560
      • C:\Users\Admin\AppData\Local\Temp\e4e055cbf0f9ae7d5102b622aa6ff851_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\e4e055cbf0f9ae7d5102b622aa6ff851_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3264
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3328
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3220
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4496
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2808
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:768
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:4320
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2712
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1948
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1152
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1320
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1068
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3788
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:5000
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2012
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4792
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4036
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4672
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:5032
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4124
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4932
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2840
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4388
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4460
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3436
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3804
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4044
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1592
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3612
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1564
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1928
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2708
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4000
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1660
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:1360
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1448
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2156
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:892
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:1012
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4584
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1300
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3540
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1292
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4848
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:752
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:536
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:648
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:4088
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:3740
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:872
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3224
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2656
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2688
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3320
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2208
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:5020
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2612
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      PID:3272
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:4948
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3872
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2980
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:2964
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:4772
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:552
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:2308
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:808
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:704
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3864
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1968
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2232
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:5056
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1040
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:4512
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1756
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:408
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:932
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3544
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        PID:2768
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:1512
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:4884
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:1856
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:3976
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:1792
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:2684
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:4532
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:2148
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2672
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                            PID:4820
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:4864
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:3404
                            • \??\c:\windows\system\explorer.exe
                              c:\windows\system\explorer.exe
                              7⤵
                              • Drops file in Windows directory
                              PID:4776
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:2336
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:2836
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:4552
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:3244
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4272
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1488
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:464
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:2008
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:1348
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:5076
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4764
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:2192
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:4692
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:2720
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:2908
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:1352
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:5060
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:2320
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:3752
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:3732
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Drops file in Windows directory
                                  PID:4424
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:3340
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:1840
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:1716
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:2244
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:972
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:2456
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:3172
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:428
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:2704
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:1616
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:2388
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:3032
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:2296
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:400
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Drops file in Windows directory
                              PID:3324
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                                PID:4312
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                        1⤵
                          PID:1416

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\Parameters.ini
                          Filesize

                          74B

                          MD5

                          6687785d6a31cdf9a5f80acb3abc459b

                          SHA1

                          1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                          SHA256

                          3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                          SHA512

                          5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                          Download Submit

                        • C:\Windows\System\explorer.exe
                          Filesize

                          2.2MB

                          MD5

                          c3c0df8fb1aec92b7f1ba43ee99eb5b4

                          SHA1

                          4f24ce02abcad4e2704cf9c055e2e53f145b428b

                          SHA256

                          0ad5e678d01d0d32abceceaafed5b699cc2e3c9759ec3b33316fdb0b132f7c81

                          SHA512

                          829eb365f5bc84255c00adac08e35ac4835f48edb39c433b26d8943832a30ea0678da1c5a9a3bf3f84d927ed2d301392883fe0bdc908a2a02462118183f81439

                          Download Submit

                        • C:\Windows\System\spoolsv.exe
                          Filesize

                          2.2MB

                          MD5

                          1b6aaba549595519e852a8a53f11d1ae

                          SHA1

                          86751bdc452b0243307c448a57a671ea1132c137

                          SHA256

                          c3926398db2e5d49871f99f8f8caf5449f754417a6212476c7947fab7859c7ea

                          SHA512

                          b41b8a98a88f6d61fe892e71fc24c78db47fd3edb7774232de08fb261f1f3108bd0e608e44822e474ae93955645ccecc9bfa0002ad480f71fe196eb9cd8b6fe2

                          Download Submit

                        • memory/408-2973-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/536-1875-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/648-2653-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/648-2766-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/704-2842-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/872-1937-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1012-3766-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1068-1088-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1152-1032-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1152-1977-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1292-2507-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1300-2495-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1300-2498-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1320-1979-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1360-3684-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1440-52-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1440-46-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1440-47-0x0000000002480000-0x0000000002481000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1440-0-0x0000000002480000-0x0000000002481000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1448-1606-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1512-4377-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1564-1488-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1592-1436-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1792-4559-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1856-3451-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1928-2224-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1948-1966-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1968-3098-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1968-2953-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2008-4349-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2156-2478-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2208-2681-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2308-2817-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2320-4548-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2612-2788-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2612-2898-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2656-1952-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2688-2671-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2708-1489-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2712-971-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2712-1968-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2808-1955-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2808-2052-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2836-3966-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2836-4029-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2840-1252-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2908-4539-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2980-2797-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3220-807-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3220-91-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3220-3678-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3224-2663-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3264-77-0x0000000000440000-0x0000000000509000-memory.dmp

                          Filesize

                          804KB

                          Download

                        • memory/3264-50-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3264-49-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3264-79-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3320-1965-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3328-89-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3328-85-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3404-3870-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3436-2179-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3540-1721-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3544-3223-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3612-2200-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3732-4802-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3740-3976-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3788-1988-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3804-1364-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3872-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4036-2249-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4044-2191-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4124-1201-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4272-4238-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4320-3378-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4388-2168-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4460-1353-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4496-915-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4496-1956-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4512-2962-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4532-3654-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4584-1664-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4692-4388-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4764-4368-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4772-2808-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4792-1145-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4820-3542-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4820-3538-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4848-1797-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4932-2154-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4932-2158-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4948-4174-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/5000-1144-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/5020-1972-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/5032-3530-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/5056-4359-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download