Overview

overview

10

Static

static

10

2262ded1d4...0N.exe

windows7-x64

10

2262ded1d4...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    112s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2025 08:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2262ded1d4de1d03c50214c67d385d3da1886286bc7ce168489acc229ea863d0N.exe

  • Size

    2.2MB

  • MD5

    693fa2e6537b2fe05f2690c427133070

  • SHA1

    726326a9761ce6cab8fe401cf50be64cdc4a9d8d

  • SHA256

    2262ded1d4de1d03c50214c67d385d3da1886286bc7ce168489acc229ea863d0

  • SHA512

    a5b9029f33d7b7b2085a61de8969c1253f467cb3cdb12149e15c61dc16b1be2733f2fadb163516af07997b03fc562b0e461352bfcf741dee08c78fdfb597abd9

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWww4

Score
10/10
ponydefense_evasiondiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 31 IoCs
  • Drops file in Windows directory 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2262ded1d4de1d03c50214c67d385d3da1886286bc7ce168489acc229ea863d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2262ded1d4de1d03c50214c67d385d3da1886286bc7ce168489acc229ea863d0N.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:4452
      • C:\Users\Admin\AppData\Local\Temp\2262ded1d4de1d03c50214c67d385d3da1886286bc7ce168489acc229ea863d0N.exe
        "C:\Users\Admin\AppData\Local\Temp\2262ded1d4de1d03c50214c67d385d3da1886286bc7ce168489acc229ea863d0N.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4416
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2540
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4376
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3492
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3292
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2728
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1364
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2360
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3416
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1828
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1228
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3632
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1488
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1344
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4264
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:3004
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4176
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4584
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4768
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1396
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1128
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3604
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3164
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3728
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4340
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1960
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2740
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:808
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:392
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4980
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3052
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4940
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3304
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4804
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3528
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2876
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1256
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3376
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4820
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3524
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3484
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:112
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2116
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4592
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2044
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2792
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:644
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1432
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1848
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4248
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1852
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3356
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1568
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4908
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:184
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4104
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3988
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2892
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1104
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1660
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3280
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5020
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3504
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:5000
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4344
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:220
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:2036
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:8
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2092
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:3656
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                    PID:2956
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                        PID:3676
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1188
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                        PID:4600
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                            PID:3372
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:60
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2096
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2328
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        PID:3616
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:2844
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:2272
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                          PID:1904
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:4468
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                              PID:5008
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                                PID:2520
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                  PID:2180
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                          1⤵
                            PID:2284

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\Parameters.ini
                            Filesize

                            74B

                            MD5

                            6687785d6a31cdf9a5f80acb3abc459b

                            SHA1

                            1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                            SHA256

                            3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                            SHA512

                            5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                            Download Submit

                          • C:\Windows\System\explorer.exe
                            Filesize

                            2.2MB

                            MD5

                            74b1ef871fd47521baa0017b1274ffb1

                            SHA1

                            8e8aa6d016bf84ef6fdd8a9360b4d2c8874b929b

                            SHA256

                            dbe317a23c76c3a304c9a535220399a9164e2df36a06a92817f48e4b6763e6a0

                            SHA512

                            a399d18bd88d3133b250f9f1c05a3df382d183601ad2ce43e58813bc5ebf7fd2724fe57c2510ec255a35cfaa4b5783f5e07a4b5587e433d52b0cc3ac0197f93f

                            Download Submit

                          • C:\Windows\System\spoolsv.exe
                            Filesize

                            2.2MB

                            MD5

                            6f5cf6e16a1547057ee89324e3e1ef8b

                            SHA1

                            f70230deea62181641d5e7df5919c3b71d6bb297

                            SHA256

                            60ab2fb967a85719a892a7ae6efbcf7bd3e23aecc5967f7caeebd668954dcf87

                            SHA512

                            ff7fcea4a743927020f1c6c2fed68e548d8905591d63de529d39fa238e64043005babf3dbbdf487cbc39e99d093e637481af1f239944e8ba965870f174c30a71

                            Download Submit

                          • memory/112-2585-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/112-2581-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/184-3025-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/184-2851-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/220-3042-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/392-2306-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/808-1392-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1128-1202-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1228-1919-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1256-1654-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1344-1019-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1364-3433-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1396-2122-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1432-1901-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1488-2082-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1568-2769-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1660-2943-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1660-2947-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1828-917-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1828-1920-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/1848-2677-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1848-2680-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1852-2748-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1852-2751-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1960-2449-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/1960-2298-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2044-1882-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2092-3137-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2116-1830-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2360-846-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2360-1909-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2540-105-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2540-100-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/2792-2669-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2792-2833-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2892-2858-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2892-2863-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/2956-3338-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3052-2395-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3164-1273-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3292-1897-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3292-2085-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3304-2407-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3356-2024-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3376-2476-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3416-1906-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3416-1910-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3484-1829-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3492-716-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3492-1899-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3524-2572-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3528-2466-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3604-2189-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/3632-968-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4136-42-0x0000000002480000-0x0000000002481000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4136-48-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4136-41-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4136-0-0x0000000002480000-0x0000000002481000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4176-1100-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4248-1918-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4264-2280-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4340-1340-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4376-104-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4376-664-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4416-89-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4416-45-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4416-87-0x0000000000440000-0x0000000000509000-memory.dmp

                            Filesize

                            804KB

                            Download

                          • memory/4416-44-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4584-2112-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4584-2116-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4592-2593-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4600-3611-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/4768-1201-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4804-1592-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4820-1732-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4908-2025-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4940-1535-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/4980-1463-0x0000000000400000-0x00000000005D3000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/5000-2968-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/5000-2965-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download

                          • memory/5020-2955-0x0000000000400000-0x000000000043E000-memory.dmp

                            Filesize

                            248KB

                            Download