Overview

overview

10

Static

static

10

613007c51c...4N.exe

windows7-x64

10

613007c51c...4N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2024 15:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    613007c51cc693046a94060ac51ec024c8106b3e0177427a1a4d1badaf9eb514N.exe

  • Size

    2.2MB

  • MD5

    5d71644372abfcca5a1cbc8425f4e350

  • SHA1

    8c3b2c7649b8f85f7bcdb5c65fc1439ac25cb45a

  • SHA256

    613007c51cc693046a94060ac51ec024c8106b3e0177427a1a4d1badaf9eb514

  • SHA512

    c9d8a071a52cdeac491915af852f81e8fa740e18a09657b646b9eeabbe5525333dd67735cc94a9ffb776ce7920626951cd15218e37691f4221067b54cb3bbbf1

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZi:0UzeyQMS4DqodCnoe+iitjWwwe

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 37 IoCs
  • Drops file in Windows directory 55 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\613007c51cc693046a94060ac51ec024c8106b3e0177427a1a4d1badaf9eb514N.exe
    "C:\Users\Admin\AppData\Local\Temp\613007c51cc693046a94060ac51ec024c8106b3e0177427a1a4d1badaf9eb514N.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4952
      • C:\Users\Admin\AppData\Local\Temp\613007c51cc693046a94060ac51ec024c8106b3e0177427a1a4d1badaf9eb514N.exe
        "C:\Users\Admin\AppData\Local\Temp\613007c51cc693046a94060ac51ec024c8106b3e0177427a1a4d1badaf9eb514N.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2532
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2028
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3592
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4244
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2464
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2440
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1424
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2824
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3188
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4960
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1412
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1728
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3920
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1812
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4428
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4088
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2012
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4548
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4228
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2916
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3656
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5016
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3892
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:1644
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3708
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2656
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2840
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1200
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3568
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1660
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4276
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1956
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4092
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3896
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3492
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3440
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3580
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4304
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3064
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3284
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4232
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4496
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1784
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4252
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:588
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4168
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4636
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4964
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4620
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:5080
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1988
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2480
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:4776
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5048
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2728
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:212
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2320
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4896
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4688
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4616
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2032
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4384
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4336
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3420
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4308
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1880
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2724
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:4808
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:348
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2304
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3368
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2084
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1532
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3496
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:112
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                      PID:2512
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2108
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1136
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:4708
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:4828
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:440
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                          PID:2028
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                              PID:4796
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:3052
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:716
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          PID:1052
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:3956
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:1460
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:4804
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:3120
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Drops file in Windows directory
                          PID:4452
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:1980
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                              PID:3276
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                                PID:4424
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                        1⤵
                          PID:4536

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\Parameters.ini
                          Filesize

                          74B

                          MD5

                          6687785d6a31cdf9a5f80acb3abc459b

                          SHA1

                          1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                          SHA256

                          3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                          SHA512

                          5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                          Download Submit

                        • C:\Windows\System\explorer.exe
                          Filesize

                          2.2MB

                          MD5

                          c0443e345fde6b380a9b05f4476ef3c4

                          SHA1

                          5b5a1520c076cee2e337d8bf0f5e9a9b10b71bd7

                          SHA256

                          1f8d8b448591db7299410fbe49e92ce022fe33ffa87bd1a4c8dd42660eb81860

                          SHA512

                          48b9aedff2607c92f872a4f6acfe82d7f7e750880251eb7ac0f0e7c59c0a3a44688b578e9f6a262c6f0e98f6600ac707ac14e6fb1afde42a3e500396bb4e152c

                          Download Submit

                        • C:\Windows\System\spoolsv.exe
                          Filesize

                          2.2MB

                          MD5

                          25c822d6f98823e56d0d843965cd54f9

                          SHA1

                          d5521a9a0df1bf40309cf4f86ab4bfb11917e8bf

                          SHA256

                          f20c4d676e452c65c14a07a138f6e1f19efad9d456e7162dd5230052830355aa

                          SHA512

                          a708bd723cedf7ef8f608145809dc82f5cba625119a6521bb9f7eef390368f4b9b669ad85b1ff6348cc51f5dc11544bd0661492636c937765fe2ade14acfad6d

                          Download Submit

                        • memory/212-2453-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/404-53-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/404-46-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/404-47-0x0000000002380000-0x0000000002381000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/404-0-0x0000000002380000-0x0000000002381000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1200-2693-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1412-2465-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1424-3905-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1660-2705-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1728-1252-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1784-2149-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1812-1328-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/1880-3196-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1956-2714-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/1988-2969-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2012-2498-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2028-3895-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2028-103-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2028-109-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2032-3018-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2084-3220-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2304-3213-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2320-2999-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2464-2433-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2464-2610-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2480-2372-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2512-3439-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2512-3339-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2532-92-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2532-50-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2532-49-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2728-2989-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/2824-1130-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2824-2455-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2840-1659-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/2916-1526-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3064-2080-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3188-2451-0x0000000000440000-0x0000000000509000-memory.dmp

                          Filesize

                          804KB

                          Download

                        • memory/3188-2454-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3284-2755-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3440-2739-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3492-1906-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3496-3236-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3496-3231-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3568-1766-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3580-1988-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3592-863-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3592-108-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3656-2520-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3708-1658-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/3892-2909-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/3892-2673-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4088-1329-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4092-1905-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4168-2231-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4228-2509-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4232-2081-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4244-2440-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4244-944-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4252-3082-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4252-2940-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4276-1833-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4304-2747-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4336-3103-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4336-3319-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4428-2487-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4496-2827-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4548-1400-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4636-2949-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4688-3007-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4708-3588-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4808-3204-0x0000000000400000-0x000000000043E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4896-2464-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4960-2466-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4960-1131-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/4964-2358-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/5016-1587-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/5048-2432-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download

                        • memory/5080-2359-0x0000000000400000-0x00000000005D3000-memory.dmp

                          Filesize

                          1.8MB

                          Download