Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2024, 07:13

General

  • Target

    f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe

  • Size

    288KB

  • MD5

    f9c870d2e4af62dff412d6ca65babb18

  • SHA1

    7685d690c54281dc59afe696b07d4fa5acbe1cc4

  • SHA256

    37bf70df08384ed0262f88b296f8b961c8b11426578971d2b985a7cbadcd0f21

  • SHA512

    db05efd25166a70831586597dd82c3af85d3889eca32b07dcf108f78678e1c5014e7c50cc07879607a5629442f3c617db77506f64ffc0e4389aebc5c29c863ee

  • SSDEEP

    6144:xX8JX6MQUXu+9qjCTWeqKas8hiAHlkyvbhA5qLXtE8VZP6lnrlZdgpP:usM7u+xWEAyeAGy8V168P

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Disables taskbar notifications via registry modification
  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\AAAA8\9EC7D.exe%C:\Users\Admin\AppData\Roaming\AAAA8
      2⤵
        PID:4976
      • C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\f9c870d2e4af62dff412d6ca65babb18_JaffaCakes118.exe startC:\Program Files (x86)\A8175\lvvm.exe%C:\Program Files (x86)\A8175
        2⤵
          PID:3028
        • C:\Program Files (x86)\LP\7DBA\FB48.tmp
          "C:\Program Files (x86)\LP\7DBA\FB48.tmp"
          2⤵
          • Executes dropped EXE
          PID:4396
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2188
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4436
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4896
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4876
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2720
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4500
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4140
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1988
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4128
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3664
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:1968
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1984
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1888
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3184
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:1264
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4676
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3988
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4976
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4540
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1500
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2032
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3328
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3036
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:5056
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2984
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3716
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2664
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3352
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3628
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:5048
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4160
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3588
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:1324
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:1492
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:2484
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3028
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4044
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:1512
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4892
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:4996
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2664
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1448
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3992
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:4576
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:2408
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1624
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:3744
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:1068
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:3760
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:4120
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:1296
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:4208
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4260
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:116
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:3652
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4788
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:1796
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:3488
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1248
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:1856
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:4792
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                        1⤵
                                                                                                          PID:4524
                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                          1⤵
                                                                                                            PID:3184
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:4352
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                              1⤵
                                                                                                                PID:3116
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                1⤵
                                                                                                                  PID:3972
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:3512
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                    1⤵
                                                                                                                      PID:2300
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                      1⤵
                                                                                                                        PID:4508

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Program Files (x86)\LP\7DBA\FB48.tmp

                                                                                                                        Filesize

                                                                                                                        102KB

                                                                                                                        MD5

                                                                                                                        3dd4e5cd0cb32f735268a740c647065a

                                                                                                                        SHA1

                                                                                                                        5e88431137152bf76f61d06b1c2086ecd5082a76

                                                                                                                        SHA256

                                                                                                                        a1cb303db454c3faa73fa6705c9a7ce126110615879047fbd579d2c813fba535

                                                                                                                        SHA512

                                                                                                                        37463297b6e127dc2689f2b998b14042189baa26727ab1770fc482035b09df2cd3f349fb11038fabde84d0b4a5a07bfc6b5c619001ddc70c9c37c0aa87b3fe04

                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                        Filesize

                                                                                                                        471B

                                                                                                                        MD5

                                                                                                                        d167bef885776a71caa9137918853a44

                                                                                                                        SHA1

                                                                                                                        938e9840d92645b708450c23ea59d988b79c0f14

                                                                                                                        SHA256

                                                                                                                        a97ae8fa2227175303e2f3ea42160aced0e5d03108b249f2607aa89d25d78c40

                                                                                                                        SHA512

                                                                                                                        b79448a89d8f1b8afd68c5d16ac20348d4eee9f49aff3384b2419766f49183b7213e82a57da91230b1b780038fc7d3d6d507913c45e206c53e01745e4fe3ad57

                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

                                                                                                                        Filesize

                                                                                                                        412B

                                                                                                                        MD5

                                                                                                                        8edabf99bf2c253fd3200a8a66edd46f

                                                                                                                        SHA1

                                                                                                                        2c72fa19ade85e46f577c036e702d958b4eaed0d

                                                                                                                        SHA256

                                                                                                                        ac7c4f5048f539704f05a8b91dd6477b98bd5ce84c80e518bb238acdfa0ed835

                                                                                                                        SHA512

                                                                                                                        f359002a5dcd54afdd6de570a816fae68b3973ed0edb573f95039868c48bec6d62e0cced957e56b8d63f9487b90b612d4c6a7d1375c617df9bf8dc8b2baf9390

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        59072c9ae0773591d1e3bb7353bd19e5

                                                                                                                        SHA1

                                                                                                                        a3cb713d6b0a3bd8f23e6e6af7fe5b49a80d2266

                                                                                                                        SHA256

                                                                                                                        7c6133ce6a47c9f99a920bc808844e9ad60fdc7b46050a8fa88718fad46719e9

                                                                                                                        SHA512

                                                                                                                        2925c571789df9ebfdb57d2ee7d40eb8b80fac1f157970f2e888408474c3224fc7574bd0f96f016dbdb825d959b8b1034c5585d25999a10750ea33389a1667f5

                                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\UYRA8Z9T\microsoft.windows[1].xml

                                                                                                                        Filesize

                                                                                                                        96B

                                                                                                                        MD5

                                                                                                                        f70b80f793313b957ddc8048ae39af34

                                                                                                                        SHA1

                                                                                                                        363f9d753cde4584c60259c31c1d6217bbeb9de9

                                                                                                                        SHA256

                                                                                                                        2a786a175d4ea76e63ee7798a688339c723186a0c05604a053b0c3dbeb8df599

                                                                                                                        SHA512

                                                                                                                        8f6fe7aa95d2e6a4f4444ba0c946f243b70b2bdc54d3f1fba731b97c009030151d6e400288e75d0347abf41e5217ac448d816314114285c9498a48b244441f70

                                                                                                                      • C:\Users\Admin\AppData\Roaming\AAAA8\8175.AAA

                                                                                                                        Filesize

                                                                                                                        996B

                                                                                                                        MD5

                                                                                                                        0e9d65034159e78d00509a4fe1b93be3

                                                                                                                        SHA1

                                                                                                                        c0ff1ab42c8361a7f6e289790c6d35eb7ecdc9fd

                                                                                                                        SHA256

                                                                                                                        fbb5d8b50342a43e6f74f27d35ef8376862a33c7a417c51c131fec12a714ebcf

                                                                                                                        SHA512

                                                                                                                        c8dfc5d9217f26716f81d6a5355c7b7c9f764d091941f8b2cf27d82c53e1e87f70723422b85530dee44d1843df041bee35ba5f0e3965944ce867584014893e9f

                                                                                                                      • C:\Users\Admin\AppData\Roaming\AAAA8\8175.AAA

                                                                                                                        Filesize

                                                                                                                        600B

                                                                                                                        MD5

                                                                                                                        8897cc165071165c248ed2256a957aca

                                                                                                                        SHA1

                                                                                                                        bc559ff328ffe2d63c5ed145c6bc11dd50d3280e

                                                                                                                        SHA256

                                                                                                                        1e036a9b16074564aa06a4ce63e9c4cf0a8cb2f5324ea1802f4cecaf2bb73d00

                                                                                                                        SHA512

                                                                                                                        25d7cc4ed961d7f7a5273e2abbd20500ba13e7111b4ca7edeb8f6c6e0650eb4ffccd2865a006be90cfb76c1dd711de7e867653310b9346f316c070e8cceea021

                                                                                                                      • C:\Users\Admin\AppData\Roaming\AAAA8\8175.AAA

                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        5f406c6cf1a66a3c775f79666fdc661b

                                                                                                                        SHA1

                                                                                                                        a5e3f7b6555258edf5470323f48d3f1b51a678c7

                                                                                                                        SHA256

                                                                                                                        1b619350d6460a0ea217683072e45f73f41d8f35c019fd49aa81f054dd7e42d4

                                                                                                                        SHA512

                                                                                                                        2027ec99a219894db57c93c8700c02dcd274b736d76aea7a046d08178c55a8dda10aecb201740605857da67c0538ecd2d8a2ce710feaafe2f011c509c17cd043

                                                                                                                      • memory/1068-578-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/1448-540-0x000001BBB7870000-0x000001BBB7890000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/1448-543-0x000001BBB7E80000-0x000001BBB7EA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/1448-537-0x000001BBB78B0000-0x000001BBB78D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/1492-480-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/1500-409-0x0000000004790000-0x0000000004791000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/1888-347-0x0000021FA6640000-0x0000021FA6660000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/1888-349-0x0000021FA6600000-0x0000021FA6620000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/1888-351-0x0000021FA6A10000-0x0000021FA6A30000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/1968-340-0x0000000002900000-0x0000000002901000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/2408-554-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/2984-446-0x000001A8095F0000-0x000001A809610000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/2984-441-0x000001A809220000-0x000001A809240000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/2984-444-0x000001A808FE0000-0x000001A809000000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3020-126-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/3020-334-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/3020-320-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/3020-477-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/3020-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/3020-127-0x0000000000720000-0x0000000000820000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                      • memory/3020-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/3020-2-0x0000000000720000-0x0000000000820000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                      • memory/3028-492-0x000002494DE80000-0x000002494DEA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3028-128-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/3028-129-0x0000000000570000-0x0000000000670000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                      • memory/3028-490-0x000002494D870000-0x000002494D890000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3028-488-0x000002494D8B0000-0x000002494D8D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3036-433-0x00000000045E0000-0x00000000045E1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/3184-362-0x00000000048B0000-0x00000000048B1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/3328-421-0x000001ABD75C0000-0x000001ABD75E0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3328-417-0x000001ABD71F0000-0x000001ABD7210000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3328-419-0x000001ABD71B0000-0x000001ABD71D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3628-455-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/3744-562-0x000001E40AD80000-0x000001E40ADA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3744-565-0x000001E40AD40000-0x000001E40AD60000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3744-567-0x000001E40B150000-0x000001E40B170000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/3988-386-0x0000000004370000-0x0000000004371000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/4044-505-0x00000000043B0000-0x00000000043B1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/4120-590-0x000002180B660000-0x000002180B680000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4120-586-0x000002180B090000-0x000002180B0B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4120-588-0x000002180B050000-0x000002180B070000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4160-463-0x000001C785C40000-0x000001C785C60000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4160-467-0x000001C786220000-0x000001C786240000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4160-465-0x000001C785C00000-0x000001C785C20000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4260-603-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/4396-336-0x0000000000600000-0x0000000000700000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                      • memory/4396-335-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        116KB

                                                                                                                      • memory/4396-337-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        116KB

                                                                                                                      • memory/4500-195-0x0000023A39660000-0x0000023A39680000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4500-198-0x0000023A39620000-0x0000023A39640000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4500-200-0x0000023A39A20000-0x0000023A39A40000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4540-396-0x0000020039670000-0x0000020039690000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4540-394-0x00000200396B0000-0x00000200396D0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4540-398-0x0000020039A80000-0x0000020039AA0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4676-374-0x000001F4858A0000-0x000001F4858C0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4676-372-0x000001F485290000-0x000001F4852B0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4676-370-0x000001F4852D0000-0x000001F4852F0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4876-188-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/4892-517-0x000002172E100000-0x000002172E120000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4892-514-0x000002172DAB0000-0x000002172DAD0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4892-512-0x000002172DAF0000-0x000002172DB10000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                      • memory/4976-14-0x0000000000500000-0x0000000000600000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1024KB

                                                                                                                      • memory/4976-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/4976-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        428KB

                                                                                                                      • memory/4996-529-0x0000000004770000-0x0000000004771000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB