Overview

overview

10

Static

static

10

07fea4c409...18.exe

windows7-x64

10

07fea4c409...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    98s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 10:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    07fea4c409e5c42ba1e966903b4a3e61_JaffaCakes118.exe
  • Size 875KB
  • Sample240624-ml2vws1elm
  • SHA256 00068ce83983d5b2ebc3267c7a960ea5a7097a70a48a413f555499106f70d2d7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
modiloaderponydiscoveryevasionpersistenceratspywarestealertrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • ModiLoader Second Stage 9 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 49 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\07fea4c409e5c42ba1e966903b4a3e61_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\07fea4c409e5c42ba1e966903b4a3e61_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\07fea4c409e5c42ba1e966903b4a3e61_JaffaCakes118.exe
      07fea4c409e5c42ba1e966903b4a3e61_JaffaCakes118.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\Users\Admin\Ww9OoYLk.exe
        C:\Users\Admin\Ww9OoYLk.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1316
        • C:\Users\Admin\maewi.exe
          "C:\Users\Admin\maewi.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2700
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del Ww9OoYLk.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2288
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4272
      • C:\Users\Admin\athost.exe
        C:\Users\Admin\athost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Users\Admin\athost.exe
          athost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1976
      • C:\Users\Admin\bthost.exe
        C:\Users\Admin\bthost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Users\Admin\bthost.exe
          bthost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:720
      • C:\Users\Admin\cthost.exe
        C:\Users\Admin\cthost.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4172
        • C:\Users\Admin\cthost.exe
          C:\Users\Admin\cthost.exe startC:\Users\Admin\AppData\Roaming\EA561\D8D0A.exe%C:\Users\Admin\AppData\Roaming\EA561
          4⤵
          • Executes dropped EXE
          PID:4260
        • C:\Program Files (x86)\LP\0A3E\D7C2.tmp
          "C:\Program Files (x86)\LP\0A3E\D7C2.tmp"
          4⤵
          • Executes dropped EXE
          PID:2008
        • C:\Users\Admin\cthost.exe
          C:\Users\Admin\cthost.exe startC:\Program Files (x86)\61C70\lvvm.exe%C:\Program Files (x86)\61C70
          4⤵
          • Executes dropped EXE
          PID:536
      • C:\Users\Admin\dthost.exe
        C:\Users\Admin\dthost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:4808
        • C:\Users\Admin\ethost.exe
          C:\Users\Admin\ethost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1560
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 07fea4c409e5c42ba1e966903b4a3e61_JaffaCakes118.exe
          3⤵
            PID:2288
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              PID:4132
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2388
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4896
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4276
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3392
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2996
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3984
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2204
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2828
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3620
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4788
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3744
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2604
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1688
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:536
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4032
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2448
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4584
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4220
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4412
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:2676
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4476
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1532
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4412
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4300
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2304
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:408
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4532
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1816
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5012
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3196
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4524
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:2256
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4136
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3480
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:1136
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4776
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4196
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:2304
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3504
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3676
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:5100
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:5000
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1420
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:1860
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1328
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:5048
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:408
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3872

                                            Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Active Setup

                                                  1
                                                  T1547.014

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Active Setup

                                                  1
                                                  T1547.014

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Defense Evasion

                                                  Hide Artifacts

                                                  1
                                                  T1564

                                                  Hidden Files and Directories

                                                  1
                                                  T1564.001

                                                  Modify Registry

                                                  6
                                                  T1112

                                                  Credential Access

                                                  Unsecured Credentials

                                                  2
                                                  T1552

                                                  Credentials In Files

                                                  2
                                                  T1552.001

                                                  Discovery

                                                  Peripheral Device Discovery

                                                  3
                                                  T1120

                                                  Process Discovery

                                                  1
                                                  T1057

                                                  Query Registry

                                                  6
                                                  T1012

                                                  System Information Discovery

                                                  5
                                                  T1082

                                                  Lateral Movement

                                                  Collection

                                                  Data from Local System

                                                  2
                                                  T1005

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  D7C2.tmp
                                                  • Path C:\Program Files (x86)\LP\0A3E\D7C2.tmp
                                                  • Size 95KB
                                                  • SHA256 d4d9a7028cda13828d7a6796dd12369ab1d4af80946776aa5b5c0369dd322fb3
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                  • Size 2KB
                                                  • SHA256 ecf690090416dd3a820c13ec3c263615e3b6d5467d0f9cd3d70664792007636c
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  microsoft.windows[1].xml
                                                  • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9WOT0LPI\microsoft.windows[1].xml
                                                  • Size 96B
                                                  • SHA256 60f8214fb3bed025a0239c2d15501db6f669215d8d09371a285568ed5c5bad26
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  1C70.A56
                                                  • Path C:\Users\Admin\AppData\Roaming\EA561\1C70.A56
                                                  • Size 600B
                                                  • SHA256 3de74f269826c8e20253e58678fa70883e6d34e8b85dbfb9a422b58791c57409
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  1C70.A56
                                                  • Path C:\Users\Admin\AppData\Roaming\EA561\1C70.A56
                                                  • Size 897B
                                                  • SHA256 c7fba2c6d13a11252ade53070b485d54ecb7b623a0648ff9c9fb5c343dd98b75
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  1C70.A56
                                                  • Path C:\Users\Admin\AppData\Roaming\EA561\1C70.A56
                                                  • Size 1KB
                                                  • SHA256 be7f9d2c9f4bf182e70e42e64b4d33908cf91733e6449e1545b8668156af60d3
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  1C70.A56
                                                  • Path C:\Users\Admin\AppData\Roaming\EA561\1C70.A56
                                                  • Size 1KB
                                                  • SHA256 be31894c4fbf91c64c5f590956610dabd5437577445f8060249f69f930a50a51
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Ww9OoYLk.exe
                                                  • Path C:\Users\Admin\Ww9OoYLk.exe
                                                  • Size 256KB
                                                  • SHA256 86b35dd61f186218356ecced37723e647b612cb8c44ef904917f4c783e424809
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  athost.exe
                                                  • Path C:\Users\Admin\athost.exe
                                                  • Size 263KB
                                                  • SHA256 6151ab998d7821e147551b5ff24b11d3194c207c3ff8322fe2e2860a8b978bb0
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  bthost.exe
                                                  • Path C:\Users\Admin\bthost.exe
                                                  • Size 153KB
                                                  • SHA256 42f40ac82f47f4eb009dbd11d7233ed2e67f80392dd4fa770faa68dd973ded2f
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  cthost.exe
                                                  • Path C:\Users\Admin\cthost.exe
                                                  • Size 278KB
                                                  • SHA256 3c7ee6117b9c2e39593f452e163f16334ab1b9196b5b5616c9ff7496bb4676a0
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  dthost.exe
                                                  • Path C:\Users\Admin\dthost.exe
                                                  • Size 227KB
                                                  • SHA256 590aaa3add5efffd271c2b9cfc10fc304faf6caf83f2f9dd494a40a35b1053d3
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  ethost.exe
                                                  • Path C:\Users\Admin\ethost.exe
                                                  • Size 24KB
                                                  • SHA256 1fee129dadbd67f7fab68c8fa285b5da0141785100b35bc7b66d55b10d24364d
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  maewi.exe
                                                  • Path C:\Users\Admin\maewi.exe
                                                  • Size 256KB
                                                  • SHA256 e1739ad01862616a3747fc9e32822e679805fd46e47fd1aa127f58e7d09b98f6
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  memory/536-213-0x0000000000400000-0x000000000046B000-memory.dmp
                                                  Download

                                                  memory/536-600-0x000001E99BD00000-0x000001E99BD20000-memory.dmp
                                                  Download

                                                  memory/536-622-0x000001E99C2E0000-0x000001E99C300000-memory.dmp
                                                  Download

                                                  memory/536-610-0x000001E99BCC0000-0x000001E99BCE0000-memory.dmp
                                                  Download

                                                  memory/720-70-0x0000000000400000-0x0000000000427000-memory.dmp
                                                  Download

                                                  memory/720-69-0x0000000000400000-0x0000000000427000-memory.dmp
                                                  Download

                                                  memory/720-71-0x0000000000400000-0x0000000000427000-memory.dmp
                                                  Download

                                                  memory/720-66-0x0000000000400000-0x0000000000427000-memory.dmp
                                                  Download

                                                  memory/720-65-0x0000000000400000-0x0000000000427000-memory.dmp
                                                  Download

                                                  memory/876-82-0x0000000000400000-0x0000000000466000-memory.dmp
                                                  Download

                                                  memory/876-85-0x0000000000400000-0x0000000000466000-memory.dmp
                                                  Download

                                                  memory/1152-61-0x0000000000400000-0x000000000041E000-memory.dmp
                                                  Download

                                                  memory/1724-73-0x0000000000400000-0x000000000041E000-memory.dmp
                                                  Download

                                                  memory/1976-55-0x0000000000400000-0x0000000000437000-memory.dmp
                                                  Download

                                                  memory/1976-92-0x0000000000400000-0x0000000000437000-memory.dmp
                                                  Download

                                                  memory/1976-56-0x0000000000400000-0x0000000000437000-memory.dmp
                                                  Download

                                                  memory/1976-57-0x0000000000400000-0x0000000000437000-memory.dmp
                                                  Download

                                                  memory/1976-59-0x0000000000400000-0x0000000000437000-memory.dmp
                                                  Download

                                                  memory/1976-54-0x0000000000400000-0x0000000000437000-memory.dmp
                                                  Download

                                                  memory/2008-150-0x0000000000400000-0x000000000041B000-memory.dmp
                                                  Download

                                                  memory/2604-593-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                                                  Download

                                                  memory/2828-225-0x000002220DF80000-0x000002220DFA0000-memory.dmp
                                                  Download

                                                  memory/2828-244-0x000002220DF40000-0x000002220DF60000-memory.dmp
                                                  Download

                                                  memory/2828-255-0x000002220E350000-0x000002220E370000-memory.dmp
                                                  Download

                                                  memory/2828-220-0x000002220CE20000-0x000002220CF20000-memory.dmp
                                                  Download

                                                  memory/3620-442-0x00000000025C0000-0x00000000025C1000-memory.dmp
                                                  Download

                                                  memory/3744-465-0x000001EA16C80000-0x000001EA16CA0000-memory.dmp
                                                  Download

                                                  memory/3744-443-0x000001E214C00000-0x000001E214D00000-memory.dmp
                                                  Download

                                                  memory/3744-444-0x000001E214C00000-0x000001E214D00000-memory.dmp
                                                  Download

                                                  memory/3744-448-0x000001EA16CC0000-0x000001EA16CE0000-memory.dmp
                                                  Download

                                                  memory/3744-476-0x000001EA17090000-0x000001EA170B0000-memory.dmp
                                                  Download

                                                  memory/3984-219-0x00000000035B0000-0x00000000035B1000-memory.dmp
                                                  Download

                                                  memory/4032-742-0x0000000004F60000-0x0000000004F61000-memory.dmp
                                                  Download

                                                  memory/4172-214-0x0000000000400000-0x000000000046B000-memory.dmp
                                                  Download

                                                  memory/4172-94-0x0000000000400000-0x000000000046B000-memory.dmp
                                                  Download

                                                  memory/4172-440-0x0000000000400000-0x000000000046B000-memory.dmp
                                                  Download

                                                  memory/4260-109-0x0000000000400000-0x000000000046B000-memory.dmp
                                                  Download

                                                  memory/4584-749-0x00000150890D0000-0x00000150890F0000-memory.dmp
                                                  Download

                                                  memory/4704-8-0x0000000000400000-0x000000000041F000-memory.dmp
                                                  Download

                                                  memory/4780-0-0x0000000000400000-0x0000000000535000-memory.dmp
                                                  Download

                                                  memory/4780-7-0x0000000000400000-0x0000000000535000-memory.dmp
                                                  Download

                                                  memory/4780-86-0x0000000000400000-0x0000000000535000-memory.dmp
                                                  Download

                                                  memory/4780-5-0x0000000000400000-0x0000000000535000-memory.dmp
                                                  Download

                                                  memory/4780-4-0x0000000000400000-0x0000000000535000-memory.dmp
                                                  Download

                                                  memory/4780-1-0x0000000000400000-0x0000000000535000-memory.dmp
                                                  Download

                                                  memory/4780-216-0x0000000000400000-0x0000000000535000-memory.dmp
                                                  Download