Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

63041d1b02...0N.exe

windows7-x64

10

63041d1b02...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 15:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe

  • Size

    2.2MB

  • MD5

    ad40f03e91c9feae4efafd2b19d64600

  • SHA1

    3d6116cb68326f5c92383673c616a5aa12fc9f1e

  • SHA256

    63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700

  • SHA512

    5583a149b36599dad7a75f789000193f8d3e3994f62dfd3fd26f935765257c2d037884da66e37b7ec288bf429d81e0c489871660fefb075710c61288f0cf56e8

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZD:0UzeyQMS4DqodCnoe+iitjWww3

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 37 IoCs
  • Drops file in Windows directory 58 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe
    "C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1756
      • C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe
        "C:\Users\Admin\AppData\Local\Temp\63041d1b02fc55eff1407571d3f8fc31c2d76c1f92863f81500f06ba7ccfd700N.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5072
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4980
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4956
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2304
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4828
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2256
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1152
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3816
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4472
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4076
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3220
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3940
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3412
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1208
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4628
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1312
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2656
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1888
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4908
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2100
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4472
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:4108
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:5116
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2060
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2668
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1456
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4800
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4308
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3464
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2980
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1956
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1568
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4348
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:748
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4940
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5080
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3556
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3012
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:3212
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4420
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4504
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1716
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3016
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:760
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1796
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2320
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2308
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2436
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3896
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3900
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Drops file in Windows directory
                  PID:4876
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3092
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:2024
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:4156
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4476
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4456
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2476
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:244
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5096
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1436
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:4888
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4916
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2628
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2020
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2924
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2420
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1784
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2684
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1712
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1324
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3132
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                  PID:4700
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2472
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:1692
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4652
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:4016
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:3840
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:3864
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2768
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Drops file in Windows directory
                      PID:4160
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1048
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4352
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4556
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3512
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4416
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4948
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  PID:2180
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  PID:2464
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  PID:4404
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4452
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:428
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1928
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                    PID:4816
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
            1⤵
              PID:2900

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\Parameters.ini
              Filesize

              74B

              MD5

              6687785d6a31cdf9a5f80acb3abc459b

              SHA1

              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

              SHA256

              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

              SHA512

              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

              Download Submit

            • C:\Windows\System\explorer.exe
              Filesize

              2.2MB

              MD5

              c7bc68791b5fe028bf9fcb6fe51bdd6a

              SHA1

              bccdab5936cffe63406579b9f3f4ad47e977d75b

              SHA256

              0d87f23b37b45a142b5c93d17ffa7534ed4e8c3d8d97c5968f559d0ceacb52a9

              SHA512

              0e07a2356ab1698fda5b427505e7605f67f4d70d15e1ba5ccb87afb55bce17937e7dc9324ae4a51fb7ade861f2c983697a175a9a4918b4d11687429f2784a378

              Download Submit

            • C:\Windows\System\spoolsv.exe
              Filesize

              2.2MB

              MD5

              b93c6535b48ef2a520d150d1f45aa744

              SHA1

              d9d9ffea726d13691c91ac82a69d576a15aa8096

              SHA256

              3440d025bdfa5a864042e6b2d9cd41cc9443a99f362a7bf1e6b1d61800ef2678

              SHA512

              6e2c2843788430a3def717664a05d8c203c5cb62c7897d42954255adf5c5d667804289b5307a259bc23153b9f0e0858307758190e8bca4447d6561f5e49f9efc

              Download Submit

            • memory/748-2654-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/760-2772-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/760-2775-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/1152-3684-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/1208-1198-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/1312-1279-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/1324-3141-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/1456-2612-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/1568-2644-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/1692-3158-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/1796-2216-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/1888-1360-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/1956-1763-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2024-2964-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2060-2602-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2100-1416-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2304-2379-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2304-924-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2308-2284-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2420-3124-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2436-2792-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2476-2983-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2476-2987-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2628-3114-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2628-3264-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2656-2499-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2668-1543-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2684-54-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2684-0-0x0000000002460000-0x0000000002461000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2684-47-0x0000000002460000-0x0000000002461000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2684-46-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/2684-3132-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2768-3528-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2768-3658-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/2980-2634-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/3016-2109-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3092-2372-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3212-2021-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3220-2397-0x0000000000440000-0x0000000000509000-memory.dmp

              Filesize

              804KB

              Download

            • memory/3220-2400-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/3412-2410-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/3464-1686-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3556-1953-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3816-2388-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3816-1005-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3896-2371-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/3900-2949-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/3940-1197-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4016-3407-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4076-1076-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4076-2402-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4156-2386-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4308-2621-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4348-1764-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4420-2753-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4456-2399-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4472-2593-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4472-2387-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4472-2852-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4472-2390-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4476-2973-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4476-2976-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4504-2022-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4628-2422-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4700-3149-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4800-1604-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4828-2378-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4828-2573-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4888-3002-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4888-3006-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4908-2508-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4940-1891-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4956-98-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4956-793-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/4980-93-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/4980-100-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download

            • memory/5072-49-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/5072-50-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/5072-82-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/5080-2664-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/5096-2994-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

              Download

            • memory/5116-1542-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

              Download