Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 06:21

General

  • Target

    ef391ffe197ba8e99089ff12a6c46b59_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    ef391ffe197ba8e99089ff12a6c46b59

  • SHA1

    3d9fcde6ef56665d9c786819844e88df533c48f7

  • SHA256

    b6459460c41a6d1ee046bfc446c1a8ecc2cc8d97d56a5e90a12fdf8688cc38c7

  • SHA512

    ae8c10139fe654e0eb1fca1793bc167750451e1e7d149b9a5dc227ee4ac56e71b79f6414ad69b1bc027a66d756072357ba2cd5e116de6f9ed274067ebe7267e4

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZf:0UzeyQMS4DqodCnoe+iitjWwwr

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 55 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef391ffe197ba8e99089ff12a6c46b59_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ef391ffe197ba8e99089ff12a6c46b59_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4880
      • C:\Users\Admin\AppData\Local\Temp\ef391ffe197ba8e99089ff12a6c46b59_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ef391ffe197ba8e99089ff12a6c46b59_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4192
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4804
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1020
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1800
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4512
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:1244
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1908
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3244
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4424
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:544
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4000
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3592
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4716
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3540
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1224
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1636
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4556
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1436
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3752
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:4736
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3264
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2144
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1200
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:852
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1836
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3712
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1564
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3356
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3124
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4024
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2280
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:440
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4036
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3008
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:1876
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1316
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3112
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1028
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2788
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4748
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4876
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3684
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:2196
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4204
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3044
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5072
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2688
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:556
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4148
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2840
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:540
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:824
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2508
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:4508
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:3808
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:4980
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:5100
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:4360
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:4068
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:348
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1760
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2516
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1856
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:952
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:3776
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:2372
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:2472
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:1592
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1964
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:920
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:2252
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:2140
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:3228
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          PID:2264
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:3416
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:784
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3372
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2600
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:1288
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:3612
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:1380
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:3268
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4776
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:1848
                                • \??\c:\windows\system\explorer.exe
                                  "c:\windows\system\explorer.exe"
                                  8⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1000
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            PID:3480
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4632
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                PID:3444
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:828
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:3960
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:4476
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:5092
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:4292
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:2880
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:3420
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:692
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:4936
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:2268
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                    PID:2292
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Drops file in Windows directory
                                      PID:3500
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:4484
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:1236
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:704
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:1552
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:2636
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:4984
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            7⤵
                                            • Drops file in Windows directory
                                            PID:1960
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        PID:4816
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4400
                                          • \??\c:\windows\system\explorer.exe
                                            c:\windows\system\explorer.exe
                                            7⤵
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            PID:2692
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        PID:3820
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:1796
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          PID:3812
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                              PID:3248
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                            • Suspicious use of SetThreadContext
                                            PID:4324
                                            • \??\c:\windows\system\spoolsv.exe
                                              "c:\windows\system\spoolsv.exe"
                                              6⤵
                                                PID:1864
                                                • \??\c:\windows\system\explorer.exe
                                                  c:\windows\system\explorer.exe
                                                  7⤵
                                                    PID:4060
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:1852
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:1936
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:4252
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:1292
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:2532
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:1568
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:2132
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4168
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                PID:1284
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                PID:2168
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:5012
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3276
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4020
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  PID:3632
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:944
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:1100
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                            1⤵
                                              PID:2500

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Windows\Parameters.ini

                                              Filesize

                                              74B

                                              MD5

                                              6687785d6a31cdf9a5f80acb3abc459b

                                              SHA1

                                              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                              SHA256

                                              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                              SHA512

                                              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                            • C:\Windows\System\explorer.exe

                                              Filesize

                                              2.2MB

                                              MD5

                                              ba42209414b7daeefb7ee2c5ff1c95a7

                                              SHA1

                                              922ad02e146b01024e2d75e49d26561c329d97d0

                                              SHA256

                                              c0a9697a4feff77407e788650a5bdb2a2188a2e0b07f4d0d06a46e702c060c21

                                              SHA512

                                              cb702c15d6c8f0d7810fc72a96399ddc8f6e9e6f144479912d95481a85e260b89750b37dbbb4fbd4d5a5ba17e7699fb6d5a4751d0bc076dbbcce216c7e2c24a6

                                            • C:\Windows\System\spoolsv.exe

                                              Filesize

                                              2.2MB

                                              MD5

                                              8dcac5ae22097f3bbe2c667a6425b0bd

                                              SHA1

                                              f336de4ef387337bcc2fc21d377f9c7b9ccbae6e

                                              SHA256

                                              4ee1062f4b38baecebcf65e611b6ee60b9f4964f6dcaa474b181a0ad9fc8c4b5

                                              SHA512

                                              367873548f440c5587ba94ca847b6ced3c46fa6f7a9e2b6e6032e9d94a7286b84e93452629ab97f1df32716db840dbb2f38bff9c847984df39ba8baebe1b1400

                                            • memory/440-1498-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/540-2772-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/544-2015-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/544-972-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/556-1921-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/692-4616-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/824-2001-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/1000-4996-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1020-3817-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1020-84-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1020-699-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1028-1642-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/1200-2454-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1200-2350-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1224-2172-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1224-2277-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1288-3461-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1316-1575-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/1380-4853-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1436-1135-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/1552-4740-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1564-2387-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1760-2919-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1760-2916-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1796-4985-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1800-1984-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/1800-775-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/1836-3768-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1856-2926-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1864-5250-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1876-3930-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1908-3393-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1964-3079-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/1964-3082-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2144-1312-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/2196-4207-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2252-3093-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2280-2411-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2280-2407-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2292-4827-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2472-4634-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2688-2747-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2688-2751-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2788-2583-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2788-2579-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/2840-1981-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3044-2729-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3112-2572-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3124-2397-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3228-3300-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3228-3182-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3244-2004-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3244-906-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3248-5079-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3264-2191-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3356-1351-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3372-3243-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3372-3248-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3416-4731-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3540-1069-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3592-2026-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3592-1018-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3712-1318-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/3752-2180-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3776-3016-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3808-2837-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/3960-3937-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4000-2013-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4024-1437-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4036-2518-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4036-2642-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4068-2906-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4148-2761-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4192-45-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4192-44-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4192-73-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4204-1766-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4292-4393-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4292-4279-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4360-2023-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4400-4977-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4424-2002-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4508-2007-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4512-1983-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4556-3484-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4716-2022-0x0000000000440000-0x0000000000509000-memory.dmp

                                              Filesize

                                              804KB

                                            • memory/4716-2024-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4736-1211-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4748-1714-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4776-3566-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4776-3671-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4804-85-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4804-79-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4876-2650-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4876-2820-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4972-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4972-42-0x0000000002370000-0x0000000002371000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4972-47-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/4972-0-0x0000000002370000-0x0000000002371000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/4984-4956-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/4984-4843-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB

                                            • memory/5072-1833-0x0000000000400000-0x00000000005D3000-memory.dmp

                                              Filesize

                                              1.8MB

                                            • memory/5100-4462-0x0000000000400000-0x000000000043E000-memory.dmp

                                              Filesize

                                              248KB