Analysis
-
max time kernel
72s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
21-03-2024 12:13
General
-
Target
db98b05e2c1ef05c32c654c40612334d.exe
-
Size
279KB
-
MD5
db98b05e2c1ef05c32c654c40612334d
-
SHA1
1594dba6fa8cf76450ab5b5abbeced3fa70453de
-
SHA256
655e54ce6249faacacd7d980425424bf24f55b47b6774ce7172d06c3986af614
-
SHA512
eaa4d8521a4fd46493a52c9a8e227a8620fcb1f5bd19ddb13998a729e3579a3e68c4ee117043e992ffe5013349bb0e6965f7b42d3b432e450890e5e0de6866dc
-
SSDEEP
6144:JRuNxmk4Hgg6EEVl6YFZ3PCGsSzC+Ui/tW1/u:JMNxb+VEXtf/MPi/tWx
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 11 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 18 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 19 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe"C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exeC:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe startC:\Users\Admin\AppData\Roaming\73384\CFDC4.exe%C:\Users\Admin\AppData\Roaming\733842⤵
-
C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exeC:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe startC:\Program Files (x86)\843CF\lvvm.exe%C:\Program Files (x86)\843CF2⤵
-
C:\Program Files (x86)\LP\C467\BBAF.tmp"C:\Program Files (x86)\LP\C467\BBAF.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\LP\C467\BBAF.tmpFilesize
100KB
MD5c4e24788d32ebb00263cb427bfea8169
SHA1593fb420be4cc83ef5a4f33c6458b656a40aac99
SHA2568b7bb24edebd07960302514efd101ba7b7e467436bf84d48c0b877d54c220833
SHA51204e82e212860eee3718b33ca493961180bf1871ea50e36cab97caa395176df91102c2e64d6a6338e89557bc3066cc237e4927f2857e89591f1a08eab83e7248a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD56475b19cdf10d6f0ccf27ebf0fe76309
SHA16c3ca7a137c2b3041cdb22c994bba356e33f93c4
SHA256635f833910db4e0915ecfe0d515341d4feec384dd83d6309f71f336c838a75d1
SHA5129f695eae05fd9bc6f775cd2e8ec1a235976d82bf8b206449b0595e97afd335b31e79706b281b920e08de6d90a05a7e8b777f6d15bdbf815e61bf96e19542f4ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD5a2528811de5fe28edd452f48ff14badf
SHA1bb73467bcdbfaec0fe4e12ec51e04a691b2ff52c
SHA256f0e3956df6e91f553706db7f64a7d01f55a84fb906717e8344e3f21f8e867ac0
SHA512dd490a1c769c38b4a14f700c31d79ff7039792314751822a88012dec55f345fac4a45df5b8a0fc1d9f5043b9099fd09e2beb6e78983fbf077c7e170a56638392
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD5dea4220489698232c2853afadef90714
SHA1b10566f643e994971c5b5b685644fbdf1118e02b
SHA2562e239213129475e20d8128e69dc233ae4fb35e70b60434b09cf8b3118ee332cc
SHA512b9f20460fbfa33b2c6b101a146cc68af407f93b0ed3d060d73fd4fa5ed6af15d66c55e8b23f5edf95bfaee28f2462bcebae136e5501e958ae310c893395af64c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15Filesize
36KB
MD50e2a09c8b94747fa78ec836b5711c0c0
SHA192495421ad887f27f53784c470884802797025ad
SHA2560c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36
SHA51261530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1SA07OI6\microsoft.windows[1].xmlFilesize
97B
MD5fb9854a5b056cc3d006b38bf0eab1b7c
SHA10a2b0432e2e9938be1f652c2247827e47b265f44
SHA2563d454d15255bb82fb8a4cfa40ea848af32395be899aaaf83b6d626a814aa21c2
SHA51220366182bf5a658b19e3df4eef2fa4e484bdcecc85a893834fbcb2b0ab64100a7694c3dbbdf1597bf3e3a747ede6fe7b81aab5f07653ef40a515edbef90ed00d
-
C:\Users\Admin\AppData\Roaming\73384\43CF.338Filesize
1KB
MD5fb209d6056f727b83365adafc08738dd
SHA1de8809dc8b58a806aba4a45dc1daf568072561fb
SHA256c80c4446c7ac4bf32f4f4bf05c7be102cde4ac4b16ec6223f11f915daaf50371
SHA512d714987e3f5a04babe70a376a4b122e51494f2e9eb16553015f7158a92054b016d3c93acafcd785781bcea985c52a1d54ec949c72f75ab44aae878a08309efc6
-
C:\Users\Admin\AppData\Roaming\73384\43CF.338Filesize
1KB
MD53b95cf92679f40e7f72ebb925347f194
SHA1fecb5ac38f3c3fed7dcccc311870d7344fabfc32
SHA2568b42406e2273cae2b28097110adb6b55511bf6afc71ad89da4b8aa9c88de1280
SHA5123676264dd3e3b64107e0cd3856bc18323bc263b83dd19e38a4b616834343669f903fb24c21b37ae4f7c96bb152d0df16deb2c075fed0844ceb3e6d2afa98b3dc
-
C:\Users\Admin\AppData\Roaming\73384\43CF.338Filesize
996B
MD504f54a41b6fade3b0bc6fb5df149bf99
SHA117daca2223ffb4420b7dc76d1b4eecaf6458c8ba
SHA2568c570214e3add0e04c454345a3b2561957a3f9d7a849d0150432b9f88cbd0839
SHA5122b565b1ba29f6eca78981dab63e18a6d07c6687572d1f99478c1edf3ae4c601beb2ebc268616e88144cfc8d09458d3d3510df713075c1f87203ff4cddfb359db
-
C:\Users\Admin\AppData\Roaming\73384\43CF.338Filesize
600B
MD57b2ca8ba11069b0901e21599f5b2a2a2
SHA14e2df1b06bf66195da4612274fe150d89aed5721
SHA256ea4aeb1a46664f2e0bb107dc15006418f426ec348d6ef3bd6b46bdcc58524605
SHA512c1ce61ea7b546d4d4433557ddffc297b8d02ca3ccd5c6e83be9d19683d35e0aade25563975c7e12eabd27a705f173888233b8114abb15b7abd0378116750b714
-
memory/372-339-0x0000024D8B8B0000-0x0000024D8B8D0000-memory.dmpFilesize
128KB
-
memory/372-341-0x0000024D8BEC0000-0x0000024D8BEE0000-memory.dmpFilesize
128KB
-
memory/372-337-0x0000024D8B8F0000-0x0000024D8B910000-memory.dmpFilesize
128KB
-
memory/972-233-0x0000000004610000-0x0000000004611000-memory.dmpFilesize
4KB
-
memory/1368-197-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/1524-229-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1524-14-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1576-181-0x000002B04AD80000-0x000002B04ADA0000-memory.dmpFilesize
128KB
-
memory/1576-183-0x000002B04AD40000-0x000002B04AD60000-memory.dmpFilesize
128KB
-
memory/1576-185-0x000002B04B190000-0x000002B04B1B0000-memory.dmpFilesize
128KB
-
memory/1736-306-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/2100-459-0x0000025C9F500000-0x0000025C9F520000-memory.dmpFilesize
128KB
-
memory/2100-455-0x0000025C9F140000-0x0000025C9F160000-memory.dmpFilesize
128KB
-
memory/2100-457-0x0000025C9F100000-0x0000025C9F120000-memory.dmpFilesize
128KB
-
memory/2276-376-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/2552-480-0x000001F17B9C0000-0x000001F17B9E0000-memory.dmpFilesize
128KB
-
memory/2552-478-0x000001F17BD00000-0x000001F17BD20000-memory.dmpFilesize
128KB
-
memory/2552-482-0x000001F17C0D0000-0x000001F17C0F0000-memory.dmpFilesize
128KB
-
memory/2668-354-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/2700-174-0x0000000004340000-0x0000000004341000-memory.dmpFilesize
4KB
-
memory/2868-470-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/3108-257-0x0000000000630000-0x0000000000730000-memory.dmpFilesize
1024KB
-
memory/3108-252-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3108-258-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3164-423-0x0000000004640000-0x0000000004641000-memory.dmpFilesize
4KB
-
memory/3164-283-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/3276-77-0x0000000000608000-0x000000000064D000-memory.dmpFilesize
276KB
-
memory/3276-76-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3276-262-0x0000000004880000-0x0000000004881000-memory.dmpFilesize
4KB
-
memory/3808-272-0x0000019155C80000-0x0000019155CA0000-memory.dmpFilesize
128KB
-
memory/3808-274-0x00000191562A0000-0x00000191562C0000-memory.dmpFilesize
128KB
-
memory/3808-269-0x0000019155CC0000-0x0000019155CE0000-memory.dmpFilesize
128KB
-
memory/3884-388-0x00000275898E0000-0x0000027589900000-memory.dmpFilesize
128KB
-
memory/3884-384-0x0000027589310000-0x0000027589330000-memory.dmpFilesize
128KB
-
memory/3884-386-0x00000275892D0000-0x00000275892F0000-memory.dmpFilesize
128KB
-
memory/4044-361-0x000001D21C380000-0x000001D21C3A0000-memory.dmpFilesize
128KB
-
memory/4044-363-0x000001D21C340000-0x000001D21C360000-memory.dmpFilesize
128KB
-
memory/4044-365-0x000001D21C750000-0x000001D21C770000-memory.dmpFilesize
128KB
-
memory/4140-2-0x00000000004C0000-0x00000000005C0000-memory.dmpFilesize
1024KB
-
memory/4140-12-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4140-74-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4140-109-0x00000000004C0000-0x00000000005C0000-memory.dmpFilesize
1024KB
-
memory/4140-398-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4140-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4140-259-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4144-400-0x0000000004660000-0x0000000004661000-memory.dmpFilesize
4KB
-
memory/4332-431-0x0000019443670000-0x0000019443690000-memory.dmpFilesize
128KB
-
memory/4332-435-0x0000019443A40000-0x0000019443A60000-memory.dmpFilesize
128KB
-
memory/4332-433-0x0000019443630000-0x0000019443650000-memory.dmpFilesize
128KB
-
memory/4364-316-0x000002AB1E7A0000-0x000002AB1E7C0000-memory.dmpFilesize
128KB
-
memory/4364-318-0x000002AB1EBB0000-0x000002AB1EBD0000-memory.dmpFilesize
128KB
-
memory/4364-314-0x000002AB1E7E0000-0x000002AB1E800000-memory.dmpFilesize
128KB
-
memory/4508-410-0x000001DE88D40000-0x000001DE88D60000-memory.dmpFilesize
128KB
-
memory/4508-408-0x000001DE88D80000-0x000001DE88DA0000-memory.dmpFilesize
128KB
-
memory/4508-412-0x000001DE89150000-0x000001DE89170000-memory.dmpFilesize
128KB
-
memory/4728-217-0x0000024E00D90000-0x0000024E00DB0000-memory.dmpFilesize
128KB
-
memory/4728-207-0x0000024E00980000-0x0000024E009A0000-memory.dmpFilesize
128KB
-
memory/4728-205-0x0000024E009C0000-0x0000024E009E0000-memory.dmpFilesize
128KB
-
memory/4916-448-0x00000000042F0000-0x00000000042F1000-memory.dmpFilesize
4KB
-
memory/4928-296-0x000001D2CC280000-0x000001D2CC2A0000-memory.dmpFilesize
128KB
-
memory/4928-292-0x000001D2CBC60000-0x000001D2CBC80000-memory.dmpFilesize
128KB
-
memory/4928-290-0x000001D2CBCA0000-0x000001D2CBCC0000-memory.dmpFilesize
128KB
-
memory/4984-247-0x00000258E2360000-0x00000258E2380000-memory.dmpFilesize
128KB
-
memory/4984-241-0x00000258E1F60000-0x00000258E1F80000-memory.dmpFilesize
128KB
-
memory/4984-243-0x00000258E1F20000-0x00000258E1F40000-memory.dmpFilesize
128KB
-
memory/5088-329-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB