Analysis
-
max time kernel
43s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 14:50
Static task
static1
Behavioral task
behavioral1
Sample
df6d4fb5b398bc1051f5a5914d7e41b6.exe
Resource
win7-20240221-en
General
-
Target
df6d4fb5b398bc1051f5a5914d7e41b6.exe
-
Size
279KB
-
MD5
df6d4fb5b398bc1051f5a5914d7e41b6
-
SHA1
8055da8133ae2398edafd675bac8f5315dabbeba
-
SHA256
dee566569bb0f7ecb40d8148fe88e4643cfecd03fcf796866fe1cd582e023bc1
-
SHA512
61d0ce8421eb620122790d3124e231954d88cb270c54369d5d77cc135c448f9d8ca3c409ed66d47e9aecd9c25af85e2526401ab1f11260f56f919426b7fac54c
-
SSDEEP
6144:J7nr+l65RAHqjeEnozHOEKS64yoRHfmTj8UiUDTQv:J7XRGgdozHLDLRH+NXk
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
EADD.tmppid process 1032 EADD.tmp -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4328-1-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4328-3-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4440-13-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4440-15-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4328-16-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4328-119-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3504-122-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4328-248-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/4328-399-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F53.exe = "C:\\Program Files (x86)\\LP\\2566\\F53.exe" df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe -
Drops file in Program Files directory 3 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process File created C:\Program Files (x86)\LP\2566\F53.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe File opened for modification C:\Program Files (x86)\LP\2566\F53.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe File opened for modification C:\Program Files (x86)\LP\2566\EADD.tmp df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe -
Processes:
SearchApp.exeSearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
Processes:
explorer.exeexplorer.exeSearchApp.exeSearchApp.exeexplorer.exeexplorer.exeStartMenuExperienceHost.exeexplorer.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{98E4FE1A-1A2E-40EC-A2C0-84DA9FDFC862} explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{6FF44ADF-77B6-46F6-8CAB-442BCD6BEC51} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3045580317-3728985860-206385570-1000\{CB2D7EBF-8F18-4E30-A2EA-E1705B1D4297} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exepid process 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exeexplorer.exeexplorer.exeexplorer.exedescription pid process Token: SeSecurityPrivilege 1140 msiexec.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3052 explorer.exe Token: SeCreatePagefilePrivilege 3052 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3704 explorer.exe Token: SeCreatePagefilePrivilege 3704 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe Token: SeCreatePagefilePrivilege 3872 explorer.exe Token: SeShutdownPrivilege 3872 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3052 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3704 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3872 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe 3620 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
StartMenuExperienceHost.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exepid process 3080 StartMenuExperienceHost.exe 4856 StartMenuExperienceHost.exe 1564 StartMenuExperienceHost.exe 4872 SearchApp.exe 3568 StartMenuExperienceHost.exe 3912 SearchApp.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription pid process target process PID 4328 wrote to memory of 4440 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 4328 wrote to memory of 4440 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 4328 wrote to memory of 4440 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 4328 wrote to memory of 3504 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 4328 wrote to memory of 3504 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 4328 wrote to memory of 3504 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 4328 wrote to memory of 1032 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe EADD.tmp PID 4328 wrote to memory of 1032 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe EADD.tmp PID 4328 wrote to memory of 1032 4328 df6d4fb5b398bc1051f5a5914d7e41b6.exe EADD.tmp -
System policy modification 1 TTPs 2 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer df6d4fb5b398bc1051f5a5914d7e41b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe"C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exeC:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe startC:\Users\Admin\AppData\Roaming\6E2F3\B5125.exe%C:\Users\Admin\AppData\Roaming\6E2F32⤵
-
C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exeC:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe startC:\Program Files (x86)\F3EC9\lvvm.exe%C:\Program Files (x86)\F3EC92⤵
-
C:\Program Files (x86)\LP\2566\EADD.tmp"C:\Program Files (x86)\LP\2566\EADD.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\LP\2566\EADD.tmpFilesize
99KB
MD50d57642cffb4a4de227c0021ece3ec81
SHA1ce9d649dbcaf9e418064118bc26cd26c5fa50034
SHA25645fd7c3592c44074a862a22e362f2afbf4e718c0fcb13afbff95f4f7bdfe9c1d
SHA512340a0548cfdb6ab092b082d187262dcaf36c00c0b1ef2b03e3b3588105a139a2e2d55021f2151d2042b807da0a6bd7e4790fa3fa590e599d2a90fe9a8748a3fd
-
C:\Program Files (x86)\LP\2566\EADD.tmpFilesize
64KB
MD5e145c22ab4e3a6fe6e255a29f7970eac
SHA10a4aba1fe52bae314aab3f5cc45f08111e23b7d9
SHA2567b9df62ecb27b4fd6c42235f7582296e0d71917594754ef67cdec32378499d91
SHA512a1812aa5bac82dea738ad38aeac09b77fbd8801f3ae318e64d807a948277603a2f8186ad5fa1cbee124a19c3af22e820352ef0faaaf70c554f61bc13cea71271
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD5c8f4056acf8fe623a5c5d0900e7ec2e1
SHA192280060f3a3bba0c8b476604f3820bfda7bd8c1
SHA2564a18b2179c0b858a787056da6d6be51e3d474b33083f48fbd61fce93e1fcc6f8
SHA512b1c1b51b41e2d0608a65e2547da0f004bdf88866f28492898f49c61547f4c1fa5508a0067aee3460c93bfa5ec172c4999da0bc615b9d671742834485db64ace3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD5fa12e34c12ed9f04324bda57f3931b33
SHA161b07e333b8514d9d9a620a11e4d237c7cefed75
SHA256cc78ed32f287da8e227b8d5519fe071ba4abe0f9434ebf7f3ebc280caf8051ce
SHA512c18a453a81269525251cafa5a95939a0d7ecf3293f6b060eb70dcfae61bd7b468e478ffd7a8cfa8bfb1776c74673c87fe062991ad8a13a7a67025bdb9b967b46
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD5b8f1ea36718e4b5235ad8b41fbd57da0
SHA1beda0854bcb4a1ea50ebc4d79a4b6f3a72f6640b
SHA256907312ae3142e911753634649bd590adc94dc1b1cab7225720a36c96620ae62a
SHA512ba7b8660676376cef6398b9eda1116aac44555d1af96b551d434486a8d83c058037e5a9699abf560455eea781cf91a721e3adf67b7fcde31563ab9cd8cae72dd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\N3A1GXDL\microsoft.windows[1].xmlFilesize
97B
MD52a048584ff1532f817c94dc91dcd1288
SHA1a8feaa50ff20598096757253f961ed62cc8e2569
SHA256ac0e9ccd0c2a91247d80d72c35930928c1da245701ca832072bd977c61d3901a
SHA512b6e50c342123202657e524ce15e02851da3b8573494e0ba98f7b70c6438fcbee100df4eac302d1dcbd3d3123bdf14a11d232c96d998c569431887317419c1d86
-
C:\Users\Admin\AppData\Roaming\6E2F3\3EC9.E2FFilesize
600B
MD567012c2786813d8d5dcb4d40befbb4c7
SHA13b687e8af3ae364203b524ffcbaca4907030e998
SHA25655e836b41955d8611eb528716d0ada4e973a216d61b4274cd3def7777a9c61a9
SHA51295c9b021f39b93d59ee788c342963758b615ab03ab05c22012a44362537b8c1cddf371ecf4c307b462d4c197def0753badbc05d8c12d41950dd8c522d062a4fc
-
C:\Users\Admin\AppData\Roaming\6E2F3\3EC9.E2FFilesize
1KB
MD53befd125ce5fb37426b34d15bba7b4da
SHA162c1c74e072f11d6009731d49a38ad4816f72edb
SHA2563ea32ae052557a05a061e8de94e6e5b1932bc1c22975baa20f7823bf66c8b483
SHA5126a247963d1023b6146a34ccb141c43377e91ccd1b2162eef2e8dd505ad96c63d758927719c74c5e56366e0ab3c4764b5c4cea73f122b6b4182e87927dbff5bcc
-
C:\Users\Admin\AppData\Roaming\6E2F3\3EC9.E2FFilesize
996B
MD5e29208df2a7b971379f170313419253e
SHA1b439562533222d0203874ba2e1a4c136e4d5b613
SHA256cddb078d04c9e714f9fe57e5f99c697e76a610234aff73591e4832aa861c6a02
SHA5122d348b573a26fc21898fe996345a3b08a8d1444adb484851ae903890fcc7598cb939b490c6d6dc3ea2f1532c4d319bcc9d43263a5c3a97fd83e9af5d1ff2944f
-
memory/468-328-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/1032-251-0x0000000000580000-0x0000000000680000-memory.dmpFilesize
1024KB
-
memory/1032-252-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1032-250-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1064-281-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB
-
memory/1068-409-0x000002A862A60000-0x000002A862A80000-memory.dmpFilesize
128KB
-
memory/1068-413-0x000002A862E30000-0x000002A862E50000-memory.dmpFilesize
128KB
-
memory/1068-411-0x000002A862A20000-0x000002A862A40000-memory.dmpFilesize
128KB
-
memory/2008-401-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/2080-264-0x0000018B0DB90000-0x0000018B0DBB0000-memory.dmpFilesize
128KB
-
memory/2080-266-0x0000018B0DB50000-0x0000018B0DB70000-memory.dmpFilesize
128KB
-
memory/2080-269-0x0000018B0DF60000-0x0000018B0DF80000-memory.dmpFilesize
128KB
-
memory/2428-432-0x000002008EB40000-0x000002008EB60000-memory.dmpFilesize
128KB
-
memory/2428-434-0x000002008EB00000-0x000002008EB20000-memory.dmpFilesize
128KB
-
memory/2428-436-0x000002008EF10000-0x000002008EF30000-memory.dmpFilesize
128KB
-
memory/2428-385-0x0000023515C20000-0x0000023515C40000-memory.dmpFilesize
128KB
-
memory/2428-388-0x00000235159E0000-0x0000023515A00000-memory.dmpFilesize
128KB
-
memory/2428-390-0x0000023515FF0000-0x0000023516010000-memory.dmpFilesize
128KB
-
memory/2984-304-0x0000000002CF0000-0x0000000002CF1000-memory.dmpFilesize
4KB
-
memory/3484-424-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/3504-280-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3504-122-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3504-123-0x0000000000720000-0x0000000000820000-memory.dmpFilesize
1024KB
-
memory/3620-226-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/3848-378-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB
-
memory/3848-312-0x0000020657520000-0x0000020657540000-memory.dmpFilesize
128KB
-
memory/3848-315-0x00000206571D0000-0x00000206571F0000-memory.dmpFilesize
128KB
-
memory/3848-318-0x00000206578E0000-0x0000020657900000-memory.dmpFilesize
128KB
-
memory/3872-204-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/3912-238-0x000002175D5B0000-0x000002175D5D0000-memory.dmpFilesize
128KB
-
memory/3912-236-0x000002175D1A0000-0x000002175D1C0000-memory.dmpFilesize
128KB
-
memory/3912-234-0x000002175D1E0000-0x000002175D200000-memory.dmpFilesize
128KB
-
memory/3952-495-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3996-482-0x00000143B99D0000-0x00000143B99F0000-memory.dmpFilesize
128KB
-
memory/3996-479-0x00000143B9D20000-0x00000143B9D40000-memory.dmpFilesize
128KB
-
memory/3996-485-0x00000143BA0E0000-0x00000143BA100000-memory.dmpFilesize
128KB
-
memory/4204-459-0x0000025412C80000-0x0000025412CA0000-memory.dmpFilesize
128KB
-
memory/4204-456-0x0000025412CC0000-0x0000025412CE0000-memory.dmpFilesize
128KB
-
memory/4204-463-0x0000025413090000-0x00000254130B0000-memory.dmpFilesize
128KB
-
memory/4328-3-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4328-121-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/4328-2-0x00000000005A0000-0x00000000006A0000-memory.dmpFilesize
1024KB
-
memory/4328-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4328-248-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4328-16-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4328-399-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4328-119-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4380-505-0x000001538D420000-0x000001538D440000-memory.dmpFilesize
128KB
-
memory/4380-503-0x000001538D460000-0x000001538D480000-memory.dmpFilesize
128KB
-
memory/4428-291-0x000002E660A00000-0x000002E660A20000-memory.dmpFilesize
128KB
-
memory/4428-294-0x000002E660E10000-0x000002E660E30000-memory.dmpFilesize
128KB
-
memory/4428-362-0x0000023DC1F60000-0x0000023DC1F80000-memory.dmpFilesize
128KB
-
memory/4428-360-0x0000023DC1FA0000-0x0000023DC1FC0000-memory.dmpFilesize
128KB
-
memory/4428-289-0x000002E660A40000-0x000002E660A60000-memory.dmpFilesize
128KB
-
memory/4428-341-0x00000212FB100000-0x00000212FB120000-memory.dmpFilesize
128KB
-
memory/4428-338-0x00000212FAD00000-0x00000212FAD20000-memory.dmpFilesize
128KB
-
memory/4428-365-0x0000023DC2370000-0x0000023DC2390000-memory.dmpFilesize
128KB
-
memory/4428-336-0x00000212FAD40000-0x00000212FAD60000-memory.dmpFilesize
128KB
-
memory/4440-15-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4440-14-0x00000000005E0000-0x00000000006E0000-memory.dmpFilesize
1024KB
-
memory/4440-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4528-471-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/4676-448-0x0000000004490000-0x0000000004491000-memory.dmpFilesize
4KB
-
memory/4872-215-0x0000028791200000-0x0000028791220000-memory.dmpFilesize
128KB
-
memory/4872-213-0x0000028790DF0000-0x0000028790E10000-memory.dmpFilesize
128KB
-
memory/4872-211-0x0000028790E30000-0x0000028790E50000-memory.dmpFilesize
128KB
-
memory/4976-351-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/5084-257-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB