e45ddd68e2c71abb60d8043944ce184e0caa8c78ae4745bb7b765baad45823ca

Analysis

max time kernel
0s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f760c43c35d460c2a6881107f75e425.exe
Size

250KB
MD5

7f760c43c35d460c2a6881107f75e425
SHA1

e16a5eeb71a6d37c5035693d446196cbde7d4d28
SHA256

e45ddd68e2c71abb60d8043944ce184e0caa8c78ae4745bb7b765baad45823ca
SHA512

218968e5c59d88da67b2d01c21d189de5e75f324bcd45079c049d748d98d9e90b033c30310f7d294d394c78a946af5a94d1ed0484bc8d30ad64a8e0a7938c0e3
SSDEEP

6144:0hieuJDr5T8b2ufqBLjSB/MS7irtIa6cwoD8ZroSfjGFA:VeKrJJuf86AYcwoaoSbr

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	7f760c43c35d460c2a6881107f75e425.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3924-0-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3924-37-0x0000000000400000-0x00000000004B1000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3924-37-0x0000000000400000-0x00000000004B1000-memory.dmp	autoit_exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\winrar.jse	7f760c43c35d460c2a6881107f75e425.exe
File opened for modification	C:\Program Files\WinRAR\winrar.jse	7f760c43c35d460c2a6881107f75e425.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4956	PING.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3924	7f760c43c35d460c2a6881107f75e425.exe
3924	7f760c43c35d460c2a6881107f75e425.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3924	7f760c43c35d460c2a6881107f75e425.exe
3924	7f760c43c35d460c2a6881107f75e425.exe

C:\Users\Admin\AppData\Local\Temp\7f760c43c35d460c2a6881107f75e425.exe
"C:\Users\Admin\AppData\Local\Temp\7f760c43c35d460c2a6881107f75e425.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3924
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Program Files\WinRAR\winrar.jse"
  2⤵
  PID:4688
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g8
    3⤵
    PID:3892
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3892 CREDAT:17410 /prefetch:2
      4⤵
      PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\7f760c43c35d460c2a6881107f75e425.exe"
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 4 127.1
    3⤵
    - Runs ping.exe
    PID:4956

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1372

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:956

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2428

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4428

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3308

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1308

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5116

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3212

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4360

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1156

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:552

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3856

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4128

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4420

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:432

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5016

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5480

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5844

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6008

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4180

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5644

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5692

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1684

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5520

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4712

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5364

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3240

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5828

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5660

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2568

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4056

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2808

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5100

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5620

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6132

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5996

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3712

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3204

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5720

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5872

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1652

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1932

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5604

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5648

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5332

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5948

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6120

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2984

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4960

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5276

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3644

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5720

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5340

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5932

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4352

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5508

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5276

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5548

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4428

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2000

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5532

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5544

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3024

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1488

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5560

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2872

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3660

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:760

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3620

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5972

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4176

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5816

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6104

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5064

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5204

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6120

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5504

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6140

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5596

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5208

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:400

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4892

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4972

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4516

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1272

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4128

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2232

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5860

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5636

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4012

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2984

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3620

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6076

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\winrar.jse

Filesize
11KB

MD5
9208c38b58c7c7114f3149591580b980

SHA1
8154bdee622a386894636b7db046744724c3fc2b

SHA256
cb1b908e509020904b05dc6e4ec17d877d394eb60f6ec0d993ceba5839913a0c

SHA512
a421c6afa6d25185ec52a8218bddf84537407fd2f6cabe38c1be814d97920cfff693a48b4f48eb30c98437cbbb8ad30ccd28c3b4b7c24379ef36ac361ddfdbf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
471B

MD5
a6e46f2a9112ad93b05b9a99af3b121d

SHA1
dc908e930a5d443e54425f50d07a636d70b5b82f

SHA256
de015434b71f764ba29310dfde5c3084050cdb8bc9b50eb932b37d0bb1bb0d4f

SHA512
7b7e26c597af5c49717e77af04e9a36ae475d1a44c127083c9177d8a01c95981c8c067e12d26d0b9c8a55e856705f2fdc5475fb226040d0068c5d69814dcbc91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
412B

MD5
c62ef650a01839528696384a57cab9d8

SHA1
8b9eceea9fb307d5807ce5b1c46dd81b11a24922

SHA256
8ec04ca7dfde18fbfe542cbe914ea91abfc7a0e3e320e3f3414bb6e738b56290

SHA512
5228dec890bc25d3c68ea3ef6477fa0ce53445d3821e72eab8d2eba48f38f0cd4da3e5c674acf2059f02a828a18927c7348bcbedd8f080a789eede306978a8d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\16GVVF0P\microsoft.windows[1].xml

Filesize
96B

MD5
d60f23b004141aeb2eb90d6a84e68066

SHA1
7b53cc57ce2628a6e5349ea9abd1e96c2c8d6062

SHA256
755595cc4e31d99c254a30a0862716609f1af2e560b77c3402711654a6fae38c

SHA512
8dffce6b703772fba60ace785e8f85294e5c5695a55dafff850e2a6ac188663a9ccd21b1f4bfa607ec20ab987dd52055e714e31828561d30d5dd267194a74d8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.mmc

Filesize
255B

MD5
a0c4d2f989198272c1e2593e65c9c6cb

SHA1
0fa5cf2c05483bb89b611e0de9db674e9d53389c

SHA256
f3170aeec265cc49ff0f5dcb7ed7897371b0f7d1321f823f53b9b0e3a30e1d23

SHA512
209798b5b153283bea29974c1433fe8b6c14f2a54e57237d021ecc1013b8dc6931dedcc2fe173d121c719901045fdf2215177ba164c05d703f2e88a196252ec4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.mmc

Filesize
149B

MD5
b0ad7e59754e8d953129437b08846b5f

SHA1
9ed0ae9bc497b3aa65aed2130d068c4c1c70d87a

SHA256
cf80455e97e3fede569ea275fa701c0f185eeba64f695286647afe56d29e2c37

SHA512
53e6ce64ad4e9f5696de92a32f65d06dbd459fd12256481706d7e6d677a14c15238e5351f97d2eb7bfb129a0d39f2603c4d14305a86821ed56e9face0bc252b6

Download Submit
C:\Users\Public\Desktop\ACROBAT READER DC.mmc

Filesize
268B

MD5
57b00ccb3a351d6e45df0c5865020169

SHA1
c932af20d06642b4f2f0cb839cded241a90ace3d

SHA256
44771198c83ab0ed544795e6d1141330bc8f62129296e13218ef8422a9eab0d5

SHA512
334bf991e5d942a9e7f428948a93863fcacf1280518e5d1992ce36de0e2b3805195e6eadb1fbb70b6c45b371be9a7245c844231eff7c93a8f9b06b0e30d0f529

Download Submit
C:\Users\Public\Desktop\FIREFOX.mmc

Filesize
212B

MD5
e738deb26be0ae6ee9ea74b117af48dc

SHA1
44905d91300e06cc6b293dcc5bd6688d9243495b

SHA256
363989f254555ef8fb96df9010ca31c6e2035b10af004aeec341fc2ec26d117d

SHA512
12ee06669dddb6bf1f2da6f4be7beb93e17bd9e8480c119cab1ff4c011ee97680d4de7bd8bef68a0426948b2ffb421c32445387c5ed60f1d140e9ff66f96e867

Download Submit
C:\Users\Public\Desktop\GOOGLE CHROME.mmc

Filesize
250B

MD5
7dde836318d7cdbeef35f3d06a6d7b6d

SHA1
b26b884a2bd94a432a6e1da3acc5a99dc06c1d42

SHA256
951ba6b01bca3f14eabf9a657497bd172a073984e5a07a6bb39fe4ec8622aaa8

SHA512
74e3154552e693338f587e77a1f01762762406f8a782438ca9041888fb529dec7682692636f1dbd5255cd0922149a3b47c1cad0b3cd782f7f38497526fd945e6

Download Submit
C:\Users\Public\Desktop\Internet Explorer.mmc

Filesize
218B

MD5
4b9f175d36f729bc91274a478a80f85c

SHA1
7bd79be7dc7fcbe207f16c2aa3fab022a70e7809

SHA256
6533906583c1f768d716d7e9b101d35d1198d9c32a06d882aa626b2e4a51ee02

SHA512
e6ae4ff1cf1ab92cd649ceeda9c59794d8bfd1ca4500f672425d4a74aa48a0e938120d2444a2250513437da04767ff5883e81c7fa5dfa7e71b97bb967c0d5874

Download Submit
C:\Users\Public\Desktop\MICROSOFT EDGE.mmc

Filesize
252B

MD5
0b7d6914496973c48637995715d6f0d4

SHA1
9ac88bd5741ea9825e77511ddd35ad454f05bb99

SHA256
9d008d6bf529b562faba50a822eba33df5162e98265362cd23fdf5edfa65a5c8

SHA512
ed15ee3776c0eccc4020e006413ecdcdb13ee796376775e2a7fe9d0d7238b6e7633c665f4a78fa3427d9d6bf4309b35876297db2872c26ba0a945dcfc3faf85a

Download Submit
C:\Users\Public\Desktop\VLC MEDIA PLAYER.mmc

Filesize
198B

MD5
05a9ce26830a5d720143fff0263529be

SHA1
1b726387ca0cd48235aa0c72b95a56ba9d43c85e

SHA256
d15d32a3cc4c32b19be8951fd62ccf2fd9e8d40691dee12899a715f0aff298f2

SHA512
89c4fea31b80b5b3e413136c20d3edf81c9c6ecb3725c6025fa3bf7ce505aeec9bb3d269179942db5574dd152808e1d36c58604b093ed74a25049f1b4d98f58f

Download Submit
memory/552-175-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/1156-165-0x0000019B926B0000-0x0000019B926D0000-memory.dmp

Filesize
128KB

Download
memory/1156-167-0x0000019B92CC0000-0x0000019B92CE0000-memory.dmp

Filesize
128KB

Download
memory/1156-163-0x0000019B926F0000-0x0000019B92710000-memory.dmp

Filesize
128KB

Download
memory/1652-397-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/1684-261-0x00000000046C0000-0x00000000046C1000-memory.dmp

Filesize
4KB

Download
memory/2428-52-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/2808-329-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/3204-372-0x00000000036E0000-0x00000000036E1000-memory.dmp

Filesize
4KB

Download
memory/3212-156-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download
memory/3308-62-0x0000018F75A30000-0x0000018F75A50000-memory.dmp

Filesize
128KB

Download
memory/3308-60-0x0000018F75620000-0x0000018F75640000-memory.dmp

Filesize
128KB

Download
memory/3308-58-0x0000018F75660000-0x0000018F75680000-memory.dmp

Filesize
128KB

Download
memory/3924-37-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3924-0-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4056-317-0x000002DC41CD0000-0x000002DC41CF0000-memory.dmp

Filesize
128KB

Download
memory/4056-319-0x000002DC41C90000-0x000002DC41CB0000-memory.dmp

Filesize
128KB

Download
memory/4056-321-0x000002DC422A0000-0x000002DC422C0000-memory.dmp

Filesize
128KB

Download
memory/4128-187-0x0000024651D10000-0x0000024651D30000-memory.dmp

Filesize
128KB

Download
memory/4128-185-0x0000024651900000-0x0000024651920000-memory.dmp

Filesize
128KB

Download
memory/4128-183-0x0000024651940000-0x0000024651960000-memory.dmp

Filesize
128KB

Download
memory/4180-239-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/4420-195-0x0000000004150000-0x0000000004151000-memory.dmp

Filesize
4KB

Download
memory/4568-82-0x00000000040F0000-0x00000000040F1000-memory.dmp

Filesize
4KB

Download
memory/4712-269-0x00000251D3AB0000-0x00000251D3AD0000-memory.dmp

Filesize
128KB

Download
memory/4712-273-0x00000251D4080000-0x00000251D40A0000-memory.dmp

Filesize
128KB

Download
memory/4712-271-0x00000251D3A70000-0x00000251D3A90000-memory.dmp

Filesize
128KB

Download
memory/4960-457-0x000001FD29C80000-0x000001FD29CA0000-memory.dmp

Filesize
128KB

Download
memory/4960-459-0x000001FD29C40000-0x000001FD29C60000-memory.dmp

Filesize
128KB

Download
memory/5016-208-0x000001764AB00000-0x000001764AB20000-memory.dmp

Filesize
128KB

Download
memory/5016-203-0x000001764A520000-0x000001764A540000-memory.dmp

Filesize
128KB

Download
memory/5016-205-0x000001764A4E0000-0x000001764A500000-memory.dmp

Filesize
128KB

Download
memory/5116-92-0x0000027AE87A0000-0x0000027AE87C0000-memory.dmp

Filesize
128KB

Download
memory/5116-90-0x0000027AE87E0000-0x0000027AE8800000-memory.dmp

Filesize
128KB

Download
memory/5116-94-0x0000027AE8BB0000-0x0000027AE8BD0000-memory.dmp

Filesize
128KB

Download
memory/5364-283-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/5480-215-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/5604-408-0x000001D2A7FE0000-0x000001D2A8000000-memory.dmp

Filesize
128KB

Download
memory/5604-404-0x000001D2A7C20000-0x000001D2A7C40000-memory.dmp

Filesize
128KB

Download
memory/5604-406-0x000001D2A79D0000-0x000001D2A79F0000-memory.dmp

Filesize
128KB

Download
memory/5620-341-0x000001F3E6A20000-0x000001F3E6A40000-memory.dmp

Filesize
128KB

Download
memory/5620-337-0x000001F3E6660000-0x000001F3E6680000-memory.dmp

Filesize
128KB

Download
memory/5620-339-0x000001F3E6620000-0x000001F3E6640000-memory.dmp

Filesize
128KB

Download
memory/5648-420-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/5660-309-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/5692-247-0x0000014036A00000-0x0000014036A20000-memory.dmp

Filesize
128KB

Download
memory/5692-249-0x00000140367B0000-0x00000140367D0000-memory.dmp

Filesize
128KB

Download
memory/5692-251-0x0000014036DC0000-0x0000014036DE0000-memory.dmp

Filesize
128KB

Download
memory/5828-293-0x00000223C8C20000-0x00000223C8C40000-memory.dmp

Filesize
128KB

Download
memory/5828-295-0x00000223C9030000-0x00000223C9050000-memory.dmp

Filesize
128KB

Download
memory/5828-291-0x00000223C8C60000-0x00000223C8C80000-memory.dmp

Filesize
128KB

Download
memory/5872-380-0x00000214BCFF0000-0x00000214BD010000-memory.dmp

Filesize
128KB

Download
memory/5872-384-0x00000214BD3C0000-0x00000214BD3E0000-memory.dmp

Filesize
128KB

Download
memory/5872-382-0x00000214BCFB0000-0x00000214BCFD0000-memory.dmp

Filesize
128KB

Download
memory/5948-427-0x00000173AA200000-0x00000173AA220000-memory.dmp

Filesize
128KB

Download
memory/5948-431-0x00000173AA5D0000-0x00000173AA5F0000-memory.dmp

Filesize
128KB

Download
memory/5948-429-0x00000173AA1C0000-0x00000173AA1E0000-memory.dmp

Filesize
128KB

Download
memory/5996-361-0x0000014F80EC0000-0x0000014F80EE0000-memory.dmp

Filesize
128KB

Download
memory/5996-359-0x0000014F807B0000-0x0000014F807D0000-memory.dmp

Filesize
128KB

Download
memory/5996-357-0x0000014F80B00000-0x0000014F80B20000-memory.dmp

Filesize
128KB

Download
memory/6008-225-0x0000028C47FB0000-0x0000028C47FD0000-memory.dmp

Filesize
128KB

Download
memory/6008-227-0x0000028C483C0000-0x0000028C483E0000-memory.dmp

Filesize
128KB

Download
memory/6008-223-0x0000028C47FF0000-0x0000028C48010000-memory.dmp

Filesize
128KB

Download
memory/6120-450-0x0000000004650000-0x0000000004651000-memory.dmp

Filesize
4KB

Download
memory/6132-350-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download