Overview

overview

10

Static

static

10

1168149776...bN.exe

windows7-x64

10

1168149776...bN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    113s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2024 21:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1168149776fb4222fde628f1519e3bd43fe94ba658af9877c576ebc168a0933bN.exe

  • Size

    2.2MB

  • MD5

    e1fc82d1f89819b557b90f69fed82f30

  • SHA1

    3bf4b116e07dcfa84147467904e9fe7a6733d42d

  • SHA256

    1168149776fb4222fde628f1519e3bd43fe94ba658af9877c576ebc168a0933b

  • SHA512

    01f3821db61f04d81c96196edd8110091595c16aeeedd705a130947ca4dbb9f05dc18d3c83f4f6b06b97743eeb317860b54f21bd7f0a277a6d73ab28b89e4c2a

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZp:0UzeyQMS4DqodCnoe+iitjWwwl

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 31 IoCs
  • Drops file in Windows directory 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1168149776fb4222fde628f1519e3bd43fe94ba658af9877c576ebc168a0933bN.exe
    "C:\Users\Admin\AppData\Local\Temp\1168149776fb4222fde628f1519e3bd43fe94ba658af9877c576ebc168a0933bN.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4916
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4220
      • C:\Users\Admin\AppData\Local\Temp\1168149776fb4222fde628f1519e3bd43fe94ba658af9877c576ebc168a0933bN.exe
        "C:\Users\Admin\AppData\Local\Temp\1168149776fb4222fde628f1519e3bd43fe94ba658af9877c576ebc168a0933bN.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1844
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3524
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3272
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3684
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4456
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1976
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:3996
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3904
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5012
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2816
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3316
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1280
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4424
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5028
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1640
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1116
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2320
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4612
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5108
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1612
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2524
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4192
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3840
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:740
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4040
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1444
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1204
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4804
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2228
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1988
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:32
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3408
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2072
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2364
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4132
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4496
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2264
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2220
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3224
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:872
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2772
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:448
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4136
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3100
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4652
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1804
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1876
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2716
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:760
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3220
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4720
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:892
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3784
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4540
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1400
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:772
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3484
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1248
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3132
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1704
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3872
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:376
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3444
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:708
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3476
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1768
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3088
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5036
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1772
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3604
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1872
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:1040
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                        PID:4068
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:2020
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:640
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1660
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    PID:528
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1924
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Drops file in Windows directory
                    PID:1572
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4280
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:704
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                      PID:2340
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                        PID:4164
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                          PID:1964
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:4036
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                    1⤵
                      PID:1244

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Windows\Parameters.ini
                      Filesize

                      74B

                      MD5

                      6687785d6a31cdf9a5f80acb3abc459b

                      SHA1

                      1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                      SHA256

                      3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                      SHA512

                      5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                      Download Submit

                    • C:\Windows\System\explorer.exe
                      Filesize

                      2.2MB

                      MD5

                      003b0958ef97a71bdae067096f80dc12

                      SHA1

                      c6056d59b94c8a906a2c957ec2bbaef2507d6ee9

                      SHA256

                      0482e23f2d82f84fc279a20d8eddcb0f09bd2f8d0433c111acd615e93ee5f0b3

                      SHA512

                      c876b5c789b598332af820752ebca6561619a8980eb27f9e1e76636917c36efaab6dbd873b9bfb3705477d94c009751dee9b92979e7bf69830b76d51f25cd607

                      Download Submit

                    • C:\Windows\System\spoolsv.exe
                      Filesize

                      2.2MB

                      MD5

                      18962407b38be327c69538f9619c2c69

                      SHA1

                      26140615a7cc45047b80cdf3fbb892f63560de23

                      SHA256

                      e9618cfd76b560811d67a91c3d2fd3044d38ce4fce248d4456015d7ceabd7a29

                      SHA512

                      af663fd0a50e5efd3531a6788c3c80c47009c34289a0d1f7f2815eccbf30f6d1755568afba5d1d83dd12c7c5d4ec81084ad88d17ead0660d295441f5d149e1c2

                      Download Submit

                    • memory/32-2341-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/448-2600-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/740-2151-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/740-2147-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/760-2788-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/772-2890-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/872-2588-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1248-2972-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1280-992-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/1280-2011-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/1400-2008-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/1444-2319-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1444-2472-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1612-2129-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1640-2195-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1704-3029-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1704-3199-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1804-1948-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/1844-25-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1844-52-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1844-24-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1876-2678-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1876-2683-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/1988-1472-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2072-2430-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/2072-2434-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/2220-2502-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/2220-2506-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/2228-2328-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/2228-2331-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/2264-1674-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2320-1124-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2364-1607-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2524-1256-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2716-1963-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2772-1813-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2816-1977-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2816-926-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3088-3215-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3100-2671-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3100-2851-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3220-1968-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3224-1746-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3272-63-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3272-653-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3316-1975-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3408-1540-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3444-3040-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3444-3036-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3524-58-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3524-64-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3604-3226-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/3684-720-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3684-1953-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3784-1969-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3840-1333-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3904-1966-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3904-865-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3996-3490-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4040-1334-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4132-2644-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4136-1875-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4192-2138-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4424-2053-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4424-2010-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4456-2101-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4540-2883-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4540-2879-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4612-2118-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4720-2870-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/4804-1401-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4916-0-0x0000000002370000-0x0000000002371000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4916-21-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4916-28-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4916-22-0x0000000002370000-0x0000000002371000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/5012-1964-0x0000000000400000-0x000000000043E000-memory.dmp

                      Filesize

                      248KB

                      Download

                    • memory/5012-1962-0x0000000000440000-0x0000000000509000-memory.dmp

                      Filesize

                      804KB

                      Download

                    • memory/5028-1063-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/5108-1170-0x0000000000400000-0x00000000005D3000-memory.dmp

                      Filesize

                      1.8MB

                      Download