Analysis
-
max time kernel
58s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2023 13:08
Static task
static1
Behavioral task
behavioral1
Sample
c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe
Resource
win10v2004-20230831-en
General
-
Target
c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe
-
Size
301KB
-
MD5
369aad7d0673419f90ea88dd0189dd2d
-
SHA1
9189ec06db411d3f9e77f5f7ce0677529670943d
-
SHA256
c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878
-
SHA512
67a1f8825094c692515e6acf2e38fcfd86240c4a16bbb34e4c084032fec6eca03e37973f5b071a467cab1a4f5ac1bed9d19c635b2ee684c338e19a0487448235
-
SSDEEP
3072:tvikxL6IEIGe0fMEVkvPZpFcFQX98JuMPAswcVP7ReUIAxy2:ZxxL69tUEAhpFpNXcOUIA
Malware Config
Extracted
smokeloader
up4
Extracted
smokeloader
2020
http://host-file-file0.com/
http://file-file-file1.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Modifies Installed Components in the registry 2 TTPs 6 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exedescription pid process target process PID 4864 set thread context of 3520 4864 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe -
Program crash 37 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3360 3188 WerFault.exe 3944 1440 WerFault.exe explorer.exe 1156 4880 WerFault.exe SearchApp.exe 4052 4988 WerFault.exe explorer.exe 3944 1268 WerFault.exe SearchApp.exe 1088 2184 WerFault.exe explorer.exe 5052 2872 WerFault.exe SearchApp.exe 2120 3452 WerFault.exe explorer.exe 3508 4880 WerFault.exe explorer.exe 1616 4992 WerFault.exe SearchApp.exe 2012 4080 WerFault.exe explorer.exe 2996 3512 WerFault.exe explorer.exe 4684 180 WerFault.exe SearchApp.exe 3996 2220 WerFault.exe explorer.exe 2664 4468 WerFault.exe explorer.exe 4492 4796 WerFault.exe SearchApp.exe 3396 3500 WerFault.exe explorer.exe 4348 4916 WerFault.exe SearchApp.exe 5008 4484 WerFault.exe explorer.exe 3500 816 WerFault.exe SearchApp.exe 4684 3600 WerFault.exe explorer.exe 4484 1772 WerFault.exe SearchApp.exe 4040 532 WerFault.exe explorer.exe 1616 5104 WerFault.exe explorer.exe 4844 3868 WerFault.exe SearchApp.exe 4948 1352 WerFault.exe explorer.exe 3376 4456 WerFault.exe explorer.exe 4676 2712 WerFault.exe SearchApp.exe 4328 3456 WerFault.exe explorer.exe 1900 816 WerFault.exe SearchApp.exe 2888 3280 WerFault.exe explorer.exe 3604 2464 WerFault.exe SearchApp.exe 3872 3064 WerFault.exe explorer.exe 2532 836 WerFault.exe SearchApp.exe 4532 4496 WerFault.exe explorer.exe 1780 2132 WerFault.exe SearchApp.exe 3760 2736 WerFault.exe explorer.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
explorer.exeexplorer.exec4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe -
Processes:
explorer.exeSearchApp.exeSearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Internet Explorer\GPU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\Internet Explorer\GPU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
Processes:
explorer.exeexplorer.exeSearchApp.exeexplorer.exeSearchApp.exeexplorer.exeStartMenuExperienceHost.exeexplorer.exeStartMenuExperienceHost.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272677097-406801653-1594978504-1000\{98F27AF1-721D-4D34-9A33-6E9CBC7B6A5E} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272677097-406801653-1594978504-1000\{B2B88FAF-E7B0-4927-9609-8BB41E3CA4B8} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272677097-406801653-1594978504-1000\{8512C0FF-2DCA-4AC8-92CA-74207B432D02} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\MuiCache explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4272677097-406801653-1594978504-1000\{7DEC8969-9A36-42A3-8914-48A8A1FD3860} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000_Classes\Local Settings\MuiCache SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exepid process 3520 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe 3520 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 3188 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exepid process 3520 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
explorer.exeexplorer.exedescription pid process Token: SeShutdownPrivilege 3188 Token: SeCreatePagefilePrivilege 3188 Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 1440 explorer.exe Token: SeCreatePagefilePrivilege 1440 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe Token: SeShutdownPrivilege 4988 explorer.exe Token: SeCreatePagefilePrivilege 4988 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
explorer.exeexplorer.exepid process 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 4988 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 2184 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe 3452 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
StartMenuExperienceHost.exeStartMenuExperienceHost.exeexplorer.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exepid process 2056 StartMenuExperienceHost.exe 1608 StartMenuExperienceHost.exe 4880 explorer.exe 3256 StartMenuExperienceHost.exe 1268 SearchApp.exe 3656 StartMenuExperienceHost.exe 2872 SearchApp.exe 3428 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exedescription pid process target process PID 4864 wrote to memory of 3520 4864 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe PID 4864 wrote to memory of 3520 4864 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe PID 4864 wrote to memory of 3520 4864 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe PID 4864 wrote to memory of 3520 4864 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe PID 4864 wrote to memory of 3520 4864 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe PID 4864 wrote to memory of 3520 4864 c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe"C:\Users\Admin\AppData\Local\Temp\c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe"C:\Users\Admin\AppData\Local\Temp\c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3520
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 3188 -ip 31881⤵PID:4920
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3188 -s 31761⤵
- Program crash
PID:3360
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1440 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1440 -s 59762⤵
- Program crash
PID:3944
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2056
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 560 -p 1440 -ip 14401⤵PID:3412
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4988 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4988 -s 34162⤵
- Program crash
PID:4052
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1608
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4880
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4880 -s 39002⤵
- Program crash
PID:1156
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 4880 -ip 48801⤵PID:2576
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 4988 -ip 49881⤵PID:3944
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:2184 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2184 -s 72402⤵
- Program crash
PID:1088
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3256
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1268 -s 35682⤵
- Program crash
PID:3944
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 424 -p 1268 -ip 12681⤵PID:1416
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 2184 -ip 21841⤵PID:4728
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:3452 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3452 -s 73882⤵
- Program crash
PID:2120
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3656
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2872 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2872 -s 35362⤵
- Program crash
PID:5052
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 204 -p 2872 -ip 28721⤵PID:4492
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 3452 -ip 34521⤵PID:4708
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4880 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4880 -s 59362⤵
- Program crash
PID:3508
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3428
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 204 -p 4880 -ip 48801⤵PID:3568
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:4080 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4080 -s 34562⤵
- Program crash
PID:2012
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2744
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4992
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4992 -s 36122⤵
- Program crash
PID:1616
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 572 -p 4992 -ip 49921⤵PID:3468
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 424 -p 4080 -ip 40801⤵PID:3244
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3512
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3512 -s 59922⤵
- Program crash
PID:2996
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4376
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 3512 -ip 35121⤵PID:3808
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2220
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2220 -s 58402⤵
- Program crash
PID:3996
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3924
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:180
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 180 -s 35922⤵
- Program crash
PID:4684
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 436 -p 180 -ip 1801⤵PID:2212
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 2220 -ip 22201⤵PID:4128
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4468
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4468 -s 58722⤵
- Program crash
PID:2664
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4092
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 592 -p 4468 -ip 44681⤵PID:496
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3500
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3500 -s 73722⤵
- Program crash
PID:3396
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1904
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4796
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4796 -s 35882⤵
- Program crash
PID:4492
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 612 -p 4796 -ip 47961⤵PID:772
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 616 -p 3500 -ip 35001⤵PID:4368
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4484
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4484 -s 61162⤵
- Program crash
PID:5008
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2196
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4916
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4916 -s 35962⤵
- Program crash
PID:4348
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 4916 -ip 49161⤵PID:4628
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 620 -p 4484 -ip 44841⤵PID:4128
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3600
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3600 -s 52442⤵
- Program crash
PID:4684
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3848
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:816
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 816 -s 35842⤵
- Program crash
PID:3500
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 608 -p 816 -ip 8161⤵PID:1396
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 620 -p 3600 -ip 36001⤵PID:1208
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:532
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 532 -s 59362⤵
- Program crash
PID:4040
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4460
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1772
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1772 -s 35802⤵
- Program crash
PID:4484
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 592 -p 1772 -ip 17721⤵PID:3820
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 624 -p 532 -ip 5321⤵PID:2860
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5104
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5104 -s 57802⤵
- Program crash
PID:1616
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3996
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 596 -p 5104 -ip 51041⤵PID:4904
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1352
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1352 -s 73682⤵
- Program crash
PID:4948
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3820
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3868
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3868 -s 35722⤵
- Program crash
PID:4844
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 3868 -ip 38681⤵PID:4692
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 632 -p 1352 -ip 13521⤵PID:3412
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4456
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4456 -s 60482⤵
- Program crash
PID:3376
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5052
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 4456 -ip 44561⤵PID:4984
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3456
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3456 -s 41602⤵
- Program crash
PID:4328
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2256
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2712
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2712 -s 36002⤵
- Program crash
PID:4676
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 204 -p 2712 -ip 27121⤵PID:3796
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 620 -p 3456 -ip 34561⤵PID:888
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3280
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3280 -s 76082⤵
- Program crash
PID:2888
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2996
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:816
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 816 -s 34842⤵
- Program crash
PID:1900
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 496 -p 816 -ip 8161⤵PID:1384
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 584 -p 3280 -ip 32801⤵PID:4040
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3064
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3064 -s 73722⤵
- Program crash
PID:3872
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3464
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2464
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2464 -s 35562⤵
- Program crash
PID:3604
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 2464 -ip 24641⤵PID:3308
-
C:\Users\Admin\AppData\Roaming\swhwrigC:\Users\Admin\AppData\Roaming\swhwrig1⤵PID:1384
-
C:\Users\Admin\AppData\Roaming\swhwrigC:\Users\Admin\AppData\Roaming\swhwrig2⤵PID:1612
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 596 -p 3064 -ip 30641⤵PID:1268
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4496
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4496 -s 73282⤵
- Program crash
PID:4532
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4776
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:836
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 836 -s 35802⤵
- Program crash
PID:2532
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 204 -p 836 -ip 8361⤵PID:4628
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 600 -p 4496 -ip 44961⤵PID:3456
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2736
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2736 -s 60242⤵
- Program crash
PID:3760
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3952
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2132
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2132 -s 35722⤵
- Program crash
PID:1780
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 552 -p 2132 -ip 21321⤵PID:1724
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 552 -p 2736 -ip 27361⤵PID:4844
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVXQKGJP\microsoft.windows[1].xml
Filesize96B
MD5e205be2fd6b470c32211b9101f363259
SHA1620f46726b9c6e747b0e9b3298aae76eda6148e7
SHA2563152f403fa51a64a1e0497bcbde0b241bbb4d98bf01706f27d33dc7bf07972f4
SHA512df7aca16328ddbf13155f25bc8507b7e5b466ca35e640616d8f3062f5f2dbd6a8503a9ff14884caeeec578905162f6f98121d2b454bf948b2db40eb66be7a676
-
Filesize
301KB
MD5369aad7d0673419f90ea88dd0189dd2d
SHA19189ec06db411d3f9e77f5f7ce0677529670943d
SHA256c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878
SHA51267a1f8825094c692515e6acf2e38fcfd86240c4a16bbb34e4c084032fec6eca03e37973f5b071a467cab1a4f5ac1bed9d19c635b2ee684c338e19a0487448235
-
Filesize
301KB
MD5369aad7d0673419f90ea88dd0189dd2d
SHA19189ec06db411d3f9e77f5f7ce0677529670943d
SHA256c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878
SHA51267a1f8825094c692515e6acf2e38fcfd86240c4a16bbb34e4c084032fec6eca03e37973f5b071a467cab1a4f5ac1bed9d19c635b2ee684c338e19a0487448235
-
Filesize
301KB
MD5369aad7d0673419f90ea88dd0189dd2d
SHA19189ec06db411d3f9e77f5f7ce0677529670943d
SHA256c4a687bc29ce45858b3324fc43086b16119414d13180bcc5e47380ab77043878
SHA51267a1f8825094c692515e6acf2e38fcfd86240c4a16bbb34e4c084032fec6eca03e37973f5b071a467cab1a4f5ac1bed9d19c635b2ee684c338e19a0487448235