Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 15:39

General

  • Target

    SOCIAL CREDIT TEST.exe

  • Size

    19.7MB

  • MD5

    80c506da3df5e4580c06c48162bccbea

  • SHA1

    43fbccf50f91cd8e1190869b0edc96d920519c14

  • SHA256

    5699b2e12f78b7eeca0633c6a5a93effe7187565eccd7668acccf93c61ab7acb

  • SHA512

    f4a424bf758bb48da944701397ac1e82bb72a15ea4e8818535f2e52199d37e9caf4361303fee4bd9d6db528e1c0171d1612aebc5f636ca9c4ee4fd795432b8c5

  • SSDEEP

    393216:AZwsO1LNrFRdcQ87fxa3JxLCQi2LXe+FRdcQ87fxa3JmZRNIcgi:8O1xrFRdT8zaJp9Py+FRdT8zaJUaDi

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Modifies Installed Components in the registry 2 TTPs 11 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOCIAL CREDIT TEST.exe
    "C:\Users\Admin\AppData\Local\Temp\SOCIAL CREDIT TEST.exe"
    1⤵
    • UAC bypass
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Drops startup file
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2848
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3832
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3756
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
    1⤵
      PID:1276
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4ac 0x248
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4940
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1644
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3856
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3992
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4916
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4084
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1448
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3940
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:940
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4036
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3516
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3876
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3780
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:32
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3964
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3768
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4044
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3876
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4624
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3144
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1324
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3708
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2784
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1288
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3856
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1316
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4092
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3020
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4332
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2204
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1488
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1672
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1644
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4620
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3680
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3548
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:2624
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3944
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4368
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:2312
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:2680
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3448
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4916
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:4388
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:5104
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:4044
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4160
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4724
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3780
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1880
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4120
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3876
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4368
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4104
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3064
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4160
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3708
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2308

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                    Filesize

                                                                    2KB

                                                                    MD5

                                                                    7e4bccd6c15d331c12eab90b468638d7

                                                                    SHA1

                                                                    5aa77d50767e04c4fe215b6bd0a53b5b6ba20901

                                                                    SHA256

                                                                    66af687d47929e8540a2941f39e11cdfbf7719ebf5d581b75bff5dcc41306ec2

                                                                    SHA512

                                                                    0811443b9a800d02497fc64b14d0a870a45974e1183989297cc5d5f09dde676a2f379485117c03f54e0f3e2a270b1129da6fb0a8ebf13ea6de21d5946c23829d

                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15

                                                                    Filesize

                                                                    36KB

                                                                    MD5

                                                                    0e2a09c8b94747fa78ec836b5711c0c0

                                                                    SHA1

                                                                    92495421ad887f27f53784c470884802797025ad

                                                                    SHA256

                                                                    0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

                                                                    SHA512

                                                                    61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

                                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer

                                                                    Filesize

                                                                    36KB

                                                                    MD5

                                                                    ab0262f72142aab53d5402e6d0cb5d24

                                                                    SHA1

                                                                    eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

                                                                    SHA256

                                                                    20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

                                                                    SHA512

                                                                    bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

                                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\OE9DJ3LK\microsoft.windows[1].xml

                                                                    Filesize

                                                                    96B

                                                                    MD5

                                                                    0f6abe1ee9fa77b6b269e1a5401bbaf1

                                                                    SHA1

                                                                    e0805afe225412725e7c5e902fd5d7cfbfc30437

                                                                    SHA256

                                                                    6133a01b57b98ac5362bc51c436b99e58ba44d9b0e7db95b43dfb7d02423e056

                                                                    SHA512

                                                                    2a810ccad4f37df09425138c474d947223fe7206e045b117991ed6210101615b0e503eeb6c7454ae98b2aff0e52dcbbf4d041f728d0c7d7cf00c1f4c430cce25

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS2.jpg

                                                                    Filesize

                                                                    46KB

                                                                    MD5

                                                                    b55241e1e0f1d4ade296d3dab889001e

                                                                    SHA1

                                                                    453e60237d81d80635b1c6d91c42d3f998c9f09e

                                                                    SHA256

                                                                    7b5a5c679325ac683243d1e3cad2d971b37c37a0fb2bbc257634ce62c6387942

                                                                    SHA512

                                                                    c0bb2da6ba4f38cf2eefdd2fd8774f46a3d0ca05f77a7b79ebdf90b6f0629ca1c8ab95ffdb82f421f35954a89289683047d989dc7d2255758e15c1abff58f787

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

                                                                    Filesize

                                                                    83KB

                                                                    MD5

                                                                    d1d99a7057fc0c2e0390250a8268c546

                                                                    SHA1

                                                                    fd03b592c9222ea45391f3409d34712e01c4100b

                                                                    SHA256

                                                                    219abc8416dc23b3dfee9dbbfa3961631115519f3b0226192e9642c6280d0d65

                                                                    SHA512

                                                                    d4999a4534369919f59f20e8282bbd2058842b4e7f5d31768390f9af3ab270a85a6b2220329f2bf11b4018d90ea007063c731d8e4b54ce826ad78c17ff7a6d35

                                                                  • C:\backg.jpg

                                                                    Filesize

                                                                    74KB

                                                                    MD5

                                                                    aa8212e3f48d35711f219cd9bf1265ab

                                                                    SHA1

                                                                    a3b17cc5311f23cc2db204f5b7081cd7d170094d

                                                                    SHA256

                                                                    ddc65eb885e5f89406a0b9ec5d23b0bf041ef9c15b689ddf6b855c9a62132200

                                                                    SHA512

                                                                    1d15ea1e09dae7d5c2b507f26dff3c052888deb7e5f8d17f5baac1c76a15cc2b0f11b470d855213ba17c03b32856e921b36c8acc6a32e9ff1ab9c04dc4ccf261

                                                                  • C:\startup.exe

                                                                    Filesize

                                                                    16KB

                                                                    MD5

                                                                    12b162b0c010fcc23fa43b03cbb76509

                                                                    SHA1

                                                                    a696c6b6d5c0216b3eddf8dd4eb2a269abe19d00

                                                                    SHA256

                                                                    6be68911f16ec9283da61ce222d946c9e8e5ea39d71ad9d23216b4961947d180

                                                                    SHA512

                                                                    f983d2a19c18574cd09c1be30f44a6c8b586bfc74341367f6dfab26a6c7440f73e7ba252e66d1ed5fa6af5a78dd3f69de3909a369fe08ad78ca1e539eaa036c4

                                                                  • memory/32-603-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1288-902-0x000001EF0CB70000-0x000001EF0CB90000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1288-921-0x000001EF0CB30000-0x000001EF0CB50000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1288-933-0x000001EF0CF40000-0x000001EF0CF60000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1448-169-0x0000028AE7360000-0x0000028AE7380000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1448-194-0x0000028AE7720000-0x0000028AE7740000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1448-182-0x0000028AE7320000-0x0000028AE7340000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/1672-1193-0x0000000003340000-0x0000000003341000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2624-1345-0x00000000041F0000-0x00000000041F1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2848-893-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-601-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-1036-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-161-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-154-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-158-0x00007FFCBBA80000-0x00007FFCBC541000-memory.dmp

                                                                    Filesize

                                                                    10.8MB

                                                                  • memory/2848-1042-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-0-0x00007FFCBBA83000-0x00007FFCBBA85000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/2848-155-0x00007FFCBBA83000-0x00007FFCBBA85000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/2848-1344-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-142-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-1465-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-1497-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-1192-0x000000001F920000-0x000000001FAC9000-memory.dmp

                                                                    Filesize

                                                                    1.7MB

                                                                  • memory/2848-2-0x00007FFCBBA80000-0x00007FFCBC541000-memory.dmp

                                                                    Filesize

                                                                    10.8MB

                                                                  • memory/2848-1-0x0000000000F80000-0x0000000002344000-memory.dmp

                                                                    Filesize

                                                                    19.8MB

                                                                  • memory/3448-1498-0x0000000003F20000-0x0000000003F21000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/3516-457-0x0000000004630000-0x0000000004631000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/3708-894-0x0000000002900000-0x0000000002901000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/3768-604-0x00000183B5300000-0x00000183B5400000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/3768-620-0x00000183B6400000-0x00000183B6420000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/3768-609-0x00000183B6440000-0x00000183B6460000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/3768-631-0x00000183B6800000-0x00000183B6820000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/3780-476-0x000002038E770000-0x000002038E790000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/3780-491-0x000002038EB80000-0x000002038EBA0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/3780-465-0x000002038E7B0000-0x000002038E7D0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/3940-313-0x0000000004580000-0x0000000004581000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4036-329-0x000001F00D820000-0x000001F00D840000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4036-341-0x000001F00DC30000-0x000001F00DC50000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4036-314-0x000001F00C700000-0x000001F00C800000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4036-319-0x000001F00D860000-0x000001F00D880000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4044-748-0x0000000004100000-0x0000000004101000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4092-1043-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/4332-1062-0x000001B9C0F70000-0x000001B9C0F90000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4332-1050-0x000001B9C0FB0000-0x000001B9C0FD0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4332-1045-0x000001B9BFE50000-0x000001B9BFF50000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4332-1073-0x000001B9C1380000-0x000001B9C13A0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4368-1352-0x0000026340480000-0x00000263404A0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4368-1348-0x000002633F400000-0x000002633F500000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4368-1384-0x0000026340850000-0x0000026340870000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4368-1347-0x000002633F400000-0x000002633F500000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4368-1363-0x0000026340440000-0x0000026340460000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4388-1500-0x0000020034700000-0x0000020034800000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4620-1208-0x0000024D65AF0000-0x0000024D65B10000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4620-1231-0x0000024D66100000-0x0000024D66120000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4620-1201-0x0000024D65B30000-0x0000024D65B50000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4624-765-0x000001A1AE3C0000-0x000001A1AE3E0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4624-777-0x000001A1AE9D0000-0x000001A1AE9F0000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4624-749-0x000001A1AD300000-0x000001A1AD400000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4624-754-0x000001A1AE600000-0x000001A1AE620000-memory.dmp

                                                                    Filesize

                                                                    128KB

                                                                  • memory/4624-750-0x000001A1AD300000-0x000001A1AD400000-memory.dmp

                                                                    Filesize

                                                                    1024KB

                                                                  • memory/4916-162-0x0000000002F20000-0x0000000002F21000-memory.dmp

                                                                    Filesize

                                                                    4KB