Overview

overview

10

Static

static

3

2024-04-15...uk.exe

windows7-x64

1

2024-04-15...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    79s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-04-2024 09:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-15_35aec60c2249ab23755560b8d5dac110_ryuk.exe

  • Size

    91KB

  • MD5

    35aec60c2249ab23755560b8d5dac110

  • SHA1

    10202cad9808cedceb7678f5ae61d2fd3c62fdd0

  • SHA256

    663aa7d7b7fe085b032b8d69be2eeae80a0a03dbc9f963028ba02c8f7de3ffdf

  • SHA512

    5223ffc3e471db91fd39d8158b691fd514f247e48ca02aa60910d4616df4dda87790f24d69bf33fe4dce198d5b5e35df426316df1f9c5efae756578f47ef886b

  • SSDEEP

    1536:0uRFSPMJQAS2K7+gZfkEgaIwgKG1sWVdc9dlDXnGa9VhR68rgv:0uzSPwq7BFkErHRGHUl3t9VhRZ

Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://38.55.23.144:4430/jquery-3.3.2.slim.min.js

Attributes
  • user_agent

    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://code.jquery.com/ Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Modifies Installed Components in the registry 2 TTPs 13 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\2024-04-15_35aec60c2249ab23755560b8d5dac110_ryuk.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-04-15_35aec60c2249ab23755560b8d5dac110_ryuk.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3064
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:716
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4872
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3540
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3608
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2508
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:4364
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1176
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2960
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3900
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3352
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:728
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4820
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5080
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      PID:2876
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4052
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3268
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:1620
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3024
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4076
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3164
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3208
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1756
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4588
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1684
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4436
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:404
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1476
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4480
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3088
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:1800
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4872
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2196
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      PID:4060
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3776
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1216
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3740
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4100
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1476
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1220
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1112
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2912
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3184
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4196
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4052
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:868
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2404
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1572
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:1536
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:1524
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3448
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4796
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:2196
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4480
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4228
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:4916
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:956
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4812
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3884
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:2980
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:1964
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3404
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1380
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4440
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1388
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4064
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:4816
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:2420
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4640
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3900
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:1816
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:5044
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:1448
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4872
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:1272
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:3564
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:436
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:1888

                                                                                            Network

                                                                                            MITRE ATT&CK Matrix ATT&CK v13

                                                                                            Initial Access

                                                                                            Execution

                                                                                            Persistence

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            2
                                                                                            T1547.001

                                                                                            Privilege Escalation

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            2
                                                                                            T1547.001

                                                                                            Defense Evasion

                                                                                            Modify Registry

                                                                                            3
                                                                                            T1112

                                                                                            Credential Access

                                                                                            Discovery

                                                                                            Query Registry

                                                                                            2
                                                                                            T1012

                                                                                            Peripheral Device Discovery

                                                                                            2
                                                                                            T1120

                                                                                            System Information Discovery

                                                                                            2
                                                                                            T1082

                                                                                            Lateral Movement

                                                                                            Collection

                                                                                            Exfiltration

                                                                                            Command and Control

                                                                                            Impact

                                                                                            Resource Development

                                                                                            Reconnaissance

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              fc2e4729b8f1572bf928bef3e7936337

                                                                                              SHA1

                                                                                              385b0a878b0cc6f6988c0fa49751bf95d8ee0caa

                                                                                              SHA256

                                                                                              493daec24e345296cc77fa75cec47d9318da561d7b5c4308fe80048e7f98abca

                                                                                              SHA512

                                                                                              632a0e075b00aae40eb589907d8db5988897badbb494ce6e139868ccfd7300f719d184d1712d0ae4f780dd367a53b2c02c696ebe102cff484ca0cccc912e944a

                                                                                              Download Submit
                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6HXMW4P4\microsoft.windows[1].xml
                                                                                              Filesize

                                                                                              97B

                                                                                              MD5

                                                                                              feffd338250393eea6b6aa63cb0d77b7

                                                                                              SHA1

                                                                                              883005ab3903a0996824a9c39a312fd931ed30a7

                                                                                              SHA256

                                                                                              d7e0954477a02822a900acbdc90af0a32e2a00bc059356bb661d0aa6bbd78057

                                                                                              SHA512

                                                                                              170215ca9f94134c9d3ac4438d65c8e49ef85f160b5d3c3327f3fbd1fb7abb0ad950e838dd2e8220fd1d198f4d50546693d0f5317328fca1f7f8e81c3dbd43d2

                                                                                              Download Submit
                                                                                            • memory/404-159-0x0000000004560000-0x0000000004561000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/728-51-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/1112-239-0x000002C2F15A0000-0x000002C2F15C0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1112-237-0x000002C2F1190000-0x000002C2F11B0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1112-235-0x000002C2F11D0000-0x000002C2F11F0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1216-204-0x0000000004210000-0x0000000004211000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/1476-228-0x0000000002D70000-0x0000000002D71000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/1524-295-0x000001A41BB70000-0x000001A41BB90000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1524-297-0x000001A41BB30000-0x000001A41BB50000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1524-300-0x000001A41BF40000-0x000001A41BF60000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1572-287-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/1620-93-0x0000000004820000-0x0000000004821000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/1756-126-0x000002A2D26F0000-0x000002A2D2710000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1756-128-0x000002A2D26B0000-0x000002A2D26D0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1756-130-0x000002A2D2CC0000-0x000002A2D2CE0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/1800-179-0x00000000035A0000-0x00000000035A1000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/2196-318-0x0000025977F60000-0x0000025977F80000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2196-191-0x00000253A7CA0000-0x00000253A7CC0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2196-187-0x00000253A78D0000-0x00000253A78F0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2196-323-0x0000025978320000-0x0000025978340000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2196-189-0x00000253A7890000-0x00000253A78B0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2196-320-0x0000025977F20000-0x0000025977F40000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2404-275-0x000001E2A5BE0000-0x000001E2A5C00000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2404-277-0x000001E2A5BA0000-0x000001E2A5BC0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2404-279-0x000001E2A5FB0000-0x000001E2A5FD0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2508-15-0x000001A353670000-0x000001A353690000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2508-13-0x000001A353220000-0x000001A353240000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2508-11-0x000001A353260000-0x000001A353280000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/2876-70-0x0000000004020000-0x0000000004021000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/2912-247-0x0000000004050000-0x0000000004051000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/2960-27-0x0000000004C80000-0x0000000004C81000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/3164-118-0x0000000002D60000-0x0000000002D61000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/3268-78-0x000002CAE1300000-0x000002CAE1320000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/3268-82-0x000002CAE16C0000-0x000002CAE16E0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/3268-80-0x000002CAE0FB0000-0x000002CAE0FD0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/3352-39-0x0000023532CC0000-0x0000023532CE0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/3352-35-0x00000235326E0000-0x0000023532700000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/3352-37-0x00000235326A0000-0x00000235326C0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/3444-0-0x0000000002D50000-0x0000000002D51000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/3444-1-0x0000000002750000-0x0000000002751000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/3448-311-0x0000000004C50000-0x0000000004C51000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/3540-4-0x0000000002780000-0x0000000002781000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/4052-268-0x0000000003670000-0x0000000003671000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/4076-105-0x0000028A03A80000-0x0000028A03AA0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4076-103-0x0000028A03460000-0x0000028A03480000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4076-101-0x0000028A034A0000-0x0000028A034C0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4100-216-0x000001A299790000-0x000001A2997B0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4100-211-0x000001A2993C0000-0x000001A2993E0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4100-213-0x000001A299380000-0x000001A2993A0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4196-257-0x00000296C6450000-0x00000296C6470000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4196-259-0x00000296C6A60000-0x00000296C6A80000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4196-255-0x00000296C6490000-0x00000296C64B0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4436-151-0x000002E5F73E0000-0x000002E5F7400000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4436-149-0x000002E5F6DD0000-0x000002E5F6DF0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4436-147-0x000002E5F7020000-0x000002E5F7040000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4480-172-0x0000019390E20000-0x0000019390E40000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4480-167-0x0000019390A60000-0x0000019390A80000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4480-170-0x0000019390A20000-0x0000019390A40000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4480-330-0x0000000004910000-0x0000000004911000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/4588-139-0x0000000004030000-0x0000000004031000-memory.dmp
                                                                                              Filesize

                                                                                              4KB

                                                                                              Download
                                                                                            • memory/4916-338-0x00000174B7C40000-0x00000174B7C60000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/4916-340-0x00000174B7C00000-0x00000174B7C20000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/5080-58-0x0000018CB6B00000-0x0000018CB6B20000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/5080-60-0x0000018CB6AC0000-0x0000018CB6AE0000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download
                                                                                            • memory/5080-62-0x0000018CB70E0000-0x0000018CB7100000-memory.dmp
                                                                                              Filesize

                                                                                              128KB

                                                                                              Download