Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    58s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2024, 12:21

General

  • Target

    ed69746aa446d81ec40535f048806a4c_JaffaCakes118.exe

  • Size

    276KB

  • MD5

    ed69746aa446d81ec40535f048806a4c

  • SHA1

    083afb28943d6e75245a9a5a8d598fedb572d651

  • SHA256

    99a0be7e62206f74468ce3b6a6c6e307133a8dc5f51da3d43d7b017d51db0d60

  • SHA512

    8bfe12e54eb1ce2aa1d7b0dabb4890fb0d141bc43d5fef0f7f6575e5fc72a9703a828cad6fea8af9c428352f7c1352d78f11eb41d420126d13df75a239775599

  • SSDEEP

    6144:mGj01tuAV3qkskU8ywoyz6Bk1j2wdPVfXNpkJWv/bEf2HYfuj8:tcvMkUs/uk0mP/k8vT6wY9

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Disables taskbar notifications via registry modification
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed69746aa446d81ec40535f048806a4c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed69746aa446d81ec40535f048806a4c_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4736
    • C:\Users\Admin\AppData\Local\Temp\ed69746aa446d81ec40535f048806a4c_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ed69746aa446d81ec40535f048806a4c_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\B105D\F77D4.exe%C:\Users\Admin\AppData\Roaming\B105D
      2⤵
        PID:3992
      • C:\Users\Admin\AppData\Local\Temp\ed69746aa446d81ec40535f048806a4c_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\ed69746aa446d81ec40535f048806a4c_JaffaCakes118.exe startC:\Program Files (x86)\5DBA6\lvvm.exe%C:\Program Files (x86)\5DBA6
        2⤵
          PID:4592
        • C:\Program Files (x86)\LP\D40B\CEAA.tmp
          "C:\Program Files (x86)\LP\D40B\CEAA.tmp"
          2⤵
          • Executes dropped EXE
          PID:4884
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2280
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4996
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1624
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3468
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2464
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4560
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4224
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3588
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:832
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:2176
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4244
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4292
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4140
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4076
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4492
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3392
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1068
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:404
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3300
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4972
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        PID:216
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3988
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1068
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:3604
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:1064
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:1680
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2284
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3032
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4224
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:832
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3832
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:3540
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3972
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:2652
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:2956
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:1040
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:920
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:1424
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2460
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3560
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:2952
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2272
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:888
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:764
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3508
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4012
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:2624
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:2576
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2184
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3440
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2624
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:3524
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3680
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:2484
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:3436
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:4888
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:3612
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:4320
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:3728
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:4132
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:2316
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:1124
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4112
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                              PID:2096
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                                PID:2752
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:2020
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                  1⤵
                                                                                                    PID:644
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                    1⤵
                                                                                                      PID:2508
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:2752
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:1216
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                          1⤵
                                                                                                            PID:4168

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\Program Files (x86)\LP\D40B\CEAA.tmp

                                                                                                            Filesize

                                                                                                            97KB

                                                                                                            MD5

                                                                                                            ba97344303629a238cfca2f532434690

                                                                                                            SHA1

                                                                                                            5b33b602f875e3eb825c2832a2e7d3e4901c8771

                                                                                                            SHA256

                                                                                                            796a4920cfdc6e3d28d115ff6bb442a0e3be3b9ed4ee67d75ee35b4ffce537a9

                                                                                                            SHA512

                                                                                                            e78ffa32be0be8d0ae345ba008c94bb9cc474660e64b7134df67500bfdeb95ba747e637918cf1d190bd663efa6de331b3955213fba99d875687df97d4b0d9c89

                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                            Filesize

                                                                                                            471B

                                                                                                            MD5

                                                                                                            5ad295ae91f56ad503604f0a6725d571

                                                                                                            SHA1

                                                                                                            eedeed2e6f5e348120aeb8bd404ea2187d7688e3

                                                                                                            SHA256

                                                                                                            cf0e078099a6a772f768fb906fb494788f3b34638f38e431a3f7c46b72ce9aad

                                                                                                            SHA512

                                                                                                            fdfdba956b6a77792313bb48234308aca416d9d8adf507ef58ecce0a170527b5b88def9d6fceed92d23bc129280414147450efae3be5adadc5ff1e64031499ac

                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                            Filesize

                                                                                                            412B

                                                                                                            MD5

                                                                                                            516dbe72b98067583acf05e33a571d25

                                                                                                            SHA1

                                                                                                            f65d20b2a94ea7487fd4f03325a146aebd42977d

                                                                                                            SHA256

                                                                                                            f67e5e793d8dd278cc45a921dffed78f78452ea9016d6678753c298919d7388f

                                                                                                            SHA512

                                                                                                            ef7f8013cfcb4da20266ef896a99c5d0efc1cd3de628236f2278408130f692f0f986d9c991402bf59a8fa7746a27682c36cdb2016eacd1b9fbe616a000a420f7

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4VHCF0PY\microsoft.windows[1].xml

                                                                                                            Filesize

                                                                                                            97B

                                                                                                            MD5

                                                                                                            b00643a38637847dab98bfa6c2d53f4e

                                                                                                            SHA1

                                                                                                            983055bd38dff9849c550ae053cd3592db217147

                                                                                                            SHA256

                                                                                                            a64b8e9193f1537d2bb5f68c17018abf732832ebe4885933819f019ff9410841

                                                                                                            SHA512

                                                                                                            9acf44ec12ef307e812442dfd45408a6d6db702b698ae1b47b9ea8643fb0747d38baae833e8e1b9d2b540c1bfb5e2e34698c7cf6cb73555075a17fd0da7db9e2

                                                                                                          • C:\Users\Admin\AppData\Roaming\B105D\DBA6.105

                                                                                                            Filesize

                                                                                                            600B

                                                                                                            MD5

                                                                                                            25b1c9e08c950b88a7e0f76200569086

                                                                                                            SHA1

                                                                                                            a25ac24910a298f3c18f33bdd41feb79b8a824b3

                                                                                                            SHA256

                                                                                                            c90b4c659f81773cff01a284639c886f78d6d39ee0be51686eab732c08ea2bd1

                                                                                                            SHA512

                                                                                                            4ea80dab58a5e5f75d577b8407a3de7dbe9165318b9348f2c3b4494c046aefcb812f6028f72cfab6c676af2936133a9a67efc4b131752f11f88bec2ce76c0f2a

                                                                                                          • C:\Users\Admin\AppData\Roaming\B105D\DBA6.105

                                                                                                            Filesize

                                                                                                            996B

                                                                                                            MD5

                                                                                                            885e3ef9e67123d594d88fefa22edd4a

                                                                                                            SHA1

                                                                                                            4e047675f70b31f793af260f14f26b7089b470f6

                                                                                                            SHA256

                                                                                                            e79f2b97cf3b2922244cd51e0360ecc519022d57b9bc3e67bd7fe5802754d283

                                                                                                            SHA512

                                                                                                            87959b1668d1b032c2f25043b503013190ddfd0776e646c452cb4bb0bc33736773552903f4cfc5ec37c34de6290ca9baac883f56a8ff4b4bbbf98667c09cda4c

                                                                                                          • C:\Users\Admin\AppData\Roaming\B105D\DBA6.105

                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            06f42579fc6c593ba3d730a3ec96e594

                                                                                                            SHA1

                                                                                                            6d3b50a0dacf1fe8d54306068a5a85502f8d5d7f

                                                                                                            SHA256

                                                                                                            ab6f9693070782d635935b6549e344087e1ec4d2d998454b926a7a64a05214e6

                                                                                                            SHA512

                                                                                                            d2e12de2c06d441a0c5bd64b8fd4c8fe0eab6f7e1c158cdf5489b9ee7cdf84fa4564bbb2a382b3cf23ed50103bec51dded2996f8f9d00ebd9dda04828e217c9b

                                                                                                          • memory/216-439-0x0000000004240000-0x0000000004241000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/404-420-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/832-507-0x00000000047A0000-0x00000000047A1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/832-355-0x0000021646320000-0x0000021646340000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/832-357-0x0000021646720000-0x0000021646740000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/832-353-0x0000021646360000-0x0000021646380000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1040-551-0x00000000042B0000-0x00000000042B1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/1068-406-0x000001C897520000-0x000001C897540000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1068-449-0x000001AB9E720000-0x000001AB9E740000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1068-408-0x000001C8971D0000-0x000001C8971F0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1068-410-0x000001C8978E0000-0x000001C897900000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1068-452-0x000001AB9EB60000-0x000001AB9EB80000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1068-447-0x000001AB9E760000-0x000001AB9E780000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1424-561-0x0000020B1AA40000-0x0000020B1AA60000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1424-563-0x0000020B1AE50000-0x0000020B1AE70000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1424-559-0x0000020B1AA80000-0x0000020B1AAA0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1680-471-0x000001D64F800000-0x000001D64F820000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1680-473-0x000001D64F5B0000-0x000001D64F5D0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/1680-475-0x000001D64FBC0000-0x000001D64FBE0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/2176-373-0x00000000045F0000-0x00000000045F1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2272-592-0x0000000004870000-0x0000000004871000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2284-483-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2460-572-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/2952-580-0x0000020FB4190000-0x0000020FB41B0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/2952-585-0x0000020FB4560000-0x0000020FB4580000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/2952-582-0x0000020FB4150000-0x0000020FB4170000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/2956-539-0x0000020FE8F60000-0x0000020FE8F80000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/2956-541-0x0000020FE8F20000-0x0000020FE8F40000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/2956-545-0x0000020FE9320000-0x0000020FE9340000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/3468-315-0x0000000003140000-0x0000000003141000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/3540-517-0x000001EFDAC20000-0x000001EFDAC40000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/3540-519-0x000001EFDB030000-0x000001EFDB050000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/3540-515-0x000001EFDAC60000-0x000001EFDAC80000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/3604-463-0x0000000004030000-0x0000000004031000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/3972-531-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/3992-14-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/3992-15-0x00000000007DD000-0x00000000007FF000-memory.dmp

                                                                                                            Filesize

                                                                                                            136KB

                                                                                                          • memory/4224-495-0x0000022AA8110000-0x0000022AA8130000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4224-491-0x0000022AA7D40000-0x0000022AA7D60000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4224-345-0x0000000002B50000-0x0000000002B51000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4224-493-0x0000022AA7D00000-0x0000022AA7D20000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4292-380-0x0000016310E20000-0x0000016310E40000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4292-385-0x00000163111F0000-0x0000016311210000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4292-382-0x0000016310BE0000-0x0000016310C00000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4492-398-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                                                            Filesize

                                                                                                            4KB

                                                                                                          • memory/4560-324-0x000001F2B5A30000-0x000001F2B5A50000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4560-322-0x000001F2B5A70000-0x000001F2B5A90000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4560-326-0x000001F2B5E40000-0x000001F2B5E60000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4592-131-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/4592-132-0x0000000000670000-0x0000000000770000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                          • memory/4592-396-0x0000000000670000-0x0000000000770000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                          • memory/4736-505-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/4736-129-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/4736-2-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/4736-3-0x00000000004B0000-0x00000000005B0000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                          • memory/4736-16-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/4736-394-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/4736-0-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                                            Filesize

                                                                                                            420KB

                                                                                                          • memory/4736-192-0x00000000004B0000-0x00000000005B0000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                          • memory/4884-369-0x00000000004A0000-0x00000000005A0000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                          • memory/4884-371-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                            Filesize

                                                                                                            112KB

                                                                                                          • memory/4884-368-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                            Filesize

                                                                                                            112KB

                                                                                                          • memory/4972-427-0x00000201032E0000-0x0000020103300000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4972-431-0x00000201038C0000-0x00000201038E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                          • memory/4972-429-0x00000201032A0000-0x00000201032C0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB