Analysis

  • max time kernel
    112s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 02:29

General

  • Target

    7be92552c818ff23cf888dd3a396303e.exe

  • Size

    812KB

  • MD5

    7be92552c818ff23cf888dd3a396303e

  • SHA1

    6daa1196205efcb4b713dd0898f9c5b00913579d

  • SHA256

    6e0ae3fbac10daeec144d540fa5e45bd8491f7d5caa4443967ad7e51f53bcd57

  • SHA512

    81b8f165ec3fb9642b7d79712da0201dce71a542da1b5325efcb4ea69c619b1084148078ffdda4e946ce3c3cea16469586586fb8e824d9ac914d5b876a87736a

  • SSDEEP

    24576:Y+ZXDvuINUA+RBjfwSEaW8fYdQER0IR0c:Y+jU3xXPAdf8

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 29 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7be92552c818ff23cf888dd3a396303e.exe
    "C:\Users\Admin\AppData\Local\Temp\7be92552c818ff23cf888dd3a396303e.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2180
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4540
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1588
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2024
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1296
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4380
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:2748
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3384
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:2132
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1548
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:2764
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4192
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
            PID:1744
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4972
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
          1⤵
            PID:3800
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:524
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:2400
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies registry class
              PID:1092
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              PID:4028
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              PID:3492
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              PID:5072
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Modifies registry class
              PID:3220
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Modifies registry class
              PID:5028
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Modifies registry class
              PID:3908
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies registry class
              PID:2728
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2236
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:1008
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Modifies registry class
                  PID:2532
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  PID:3640
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3616
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:2424
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:4752
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Modifies registry class
                    PID:796
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:1908
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies Installed Components in the registry
                    • Modifies registry class
                    PID:4612
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1744
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Modifies registry class
                      PID:4264
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:1076
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:2652
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2484
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Modifies registry class
                            PID:4060
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4536
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:712
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies Installed Components in the registry
                                • Modifies registry class
                                PID:4564
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4528
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4512
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:2184
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:3952
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:2872
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:4080
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:4504
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:3532
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:2752
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:4744
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:3160
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:5076
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:2156
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:3248
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:3980
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:2860
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:3864
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:3904
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:4496
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    • Modifies registry class
                                    PID:4924
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies registry class
                                    PID:4616
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Modifies Installed Components in the registry
                                    PID:440
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2124
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Modifies Installed Components in the registry
                                      PID:680
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Modifies Installed Components in the registry
                                      PID:1096
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Modifies registry class
                                      PID:3912
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Modifies Installed Components in the registry
                                      • Modifies registry class
                                      PID:4452
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Modifies Installed Components in the registry
                                      PID:232
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Modifies Installed Components in the registry
                                      PID:2512
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1028
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies registry class
                                        PID:4600
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        PID:3288
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies registry class
                                        PID:800
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        PID:4596
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        • Modifies registry class
                                        PID:4728
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        PID:3792
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies registry class
                                        PID:4172
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        PID:1240
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        PID:4180
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies registry class
                                        PID:812
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        PID:4228
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        • Modifies registry class
                                        PID:3368
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        PID:3736
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2596
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies Installed Components in the registry
                                          • Modifies registry class
                                          PID:860
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies Installed Components in the registry
                                          • Modifies registry class
                                          PID:4188
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies Installed Components in the registry
                                          PID:4556
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies Installed Components in the registry
                                          PID:2096
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies Installed Components in the registry
                                          • Modifies registry class
                                          PID:1148
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies registry class
                                          PID:2624
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                          • Modifies Installed Components in the registry
                                          • Modifies registry class
                                          PID:4436
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1904
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                            • Modifies Installed Components in the registry
                                            PID:4488
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                            • Modifies Installed Components in the registry
                                            • Modifies registry class
                                            PID:2892
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                            • Modifies Installed Components in the registry
                                            PID:4016
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3292
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                              • Modifies registry class
                                              PID:4356
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                              • Modifies Installed Components in the registry
                                              PID:1940
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                              • Modifies Installed Components in the registry
                                              • Modifies registry class
                                              PID:2896
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4260
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4516
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  PID:3564
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Modifies registry class
                                                  PID:3956
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies registry class
                                                  PID:1856
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Modifies registry class
                                                  PID:1080
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  PID:3680
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                  • Modifies Installed Components in the registry
                                                  • Modifies registry class
                                                  PID:388
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1576
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4500
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3628
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4448
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:5112
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:312
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4428
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2712
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2648
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:924
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3316
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:1592
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4128
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3244
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4124
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2824
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4684
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2464
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1568
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:3396
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:1944
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4320
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3328
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3684
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:2628
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:3388
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:436
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:220
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3716
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:3312
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4044
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4888
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4524
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:4224

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                      Filesize

                                                                                                                      471B

                                                                                                                      MD5

                                                                                                                      e7727c3ff3381b5479a82f260055c1a7

                                                                                                                      SHA1

                                                                                                                      a08d7f7960e9f5eb52974bd7ea27c51e2746e23d

                                                                                                                      SHA256

                                                                                                                      663266103f6b21eac7076159912235c5751b557023a6653d01539c586378c929

                                                                                                                      SHA512

                                                                                                                      836d43317ad077bf5d5d8988115508ad26eee0721494a55d67086c1d974be6f8e455fa90301686bc4aa1ab5218e0340764849cc7c1fdabc01c51e1b05d63d07d

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                      Filesize

                                                                                                                      412B

                                                                                                                      MD5

                                                                                                                      1094cc9741165f41a2b3a944a02a5553

                                                                                                                      SHA1

                                                                                                                      d31853b65ac00fb2787a824ea38a5322e6b5b248

                                                                                                                      SHA256

                                                                                                                      d02ed13e99facd9c2e5fbc65f61c867014e34ca220db8551d93ca6b18117ca37

                                                                                                                      SHA512

                                                                                                                      2a852f5d3ed5d0c7b02dd83a19fe0d56a887a868c3a944623130d7ad75e41e60a668fb2dab01734d9d274b0f0d98a1323339cb394c498272613658ef300a107e

                                                                                                                    • C:\Users\Admin\AppData\Local\IconCache.db

                                                                                                                      Filesize

                                                                                                                      17KB

                                                                                                                      MD5

                                                                                                                      815f751e455c8eb836b9622c117cfacb

                                                                                                                      SHA1

                                                                                                                      323a4c2309b197a4eaca1d3dbbcd892d08d6ba11

                                                                                                                      SHA256

                                                                                                                      e1bfe2a2d08fa5f39d1c634a3e7cbee791f0a116e92b0f8b862e7ee2d9733af5

                                                                                                                      SHA512

                                                                                                                      dde1f301100cf39cb8083440de71abc625ad29a5c1705a4df3c62c00cecf96d4aa3f31dbb00a9b0a687affc3cf59843239d25087f40159d6f9c10568496ebc43

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                                                      Filesize

                                                                                                                      1022B

                                                                                                                      MD5

                                                                                                                      3569b094c988984a8924960cf4d8e697

                                                                                                                      SHA1

                                                                                                                      533a5f320e86df5a7fddaed86f62e34f71a728e3

                                                                                                                      SHA256

                                                                                                                      1eafa0dd6cdb6b4ed03898ce4c11e2fe87d3bbaa8bba336a96066774356b221c

                                                                                                                      SHA512

                                                                                                                      7350d9d8d6dca5d3106fdcb1e1e267f5e9e35e9e18d58f8740bbe3389ee07e3b0b456fa557e6600032961b2b4e4d12d2eb9e3246b1982d58d9c5510f7f4ed633

                                                                                                                    • memory/2180-29-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-30-0x0000000002900000-0x0000000002901000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2180-6-0x0000000002900000-0x0000000002901000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2180-5-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-18-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-4-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-2-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-42-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-27-0x0000000000BA0000-0x0000000000CA0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/2180-28-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-1-0x0000000000BA0000-0x0000000000CA0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1024KB

                                                                                                                    • memory/2180-41-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-31-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-32-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-33-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-34-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-35-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-36-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-37-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-38-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-39-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/2180-40-0x0000000000400000-0x0000000000A19000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.1MB

                                                                                                                    • memory/3384-11-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4972-22-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB