Analysis

  • max time kernel
    109s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 17:36

General

  • Target

    09e25d899e7b583f6fb52d2f85083e9c_JaffaCakes118.exe

  • Size

    868KB

  • MD5

    09e25d899e7b583f6fb52d2f85083e9c

  • SHA1

    ee6187579c2791e6dd83bbe75ea9458689d2f261

  • SHA256

    b5d84dc94b92b4d1babe8735c4c50c3389dafa1cefd49819f587d39163c61567

  • SHA512

    05aa010eaca0389d170c137b6a48268446c597bac202719e8d821946cc9d36d475b386a29e5407f03eea176e9d67e0cb89c37cbe5f8426cee9308a00d9c936ab

  • SSDEEP

    12288:Hhub2/q0bBnVaczLhb9yqFHg2rG+1e7NcHPGzU+t35dFAfmu/BihP7nxH5GYKoSe:Hwbgq0H/z9bxFHFCi6aOd5dKmuZihDB

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 29 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\09e25d899e7b583f6fb52d2f85083e9c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\09e25d899e7b583f6fb52d2f85083e9c_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:676
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2652
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1872
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2208
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1828
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:4060
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2288
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:4644
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SendNotifyMessage
          PID:4924
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3308
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Modifies registry class
          PID:2432
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4376
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
        1⤵
          PID:2904
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4984
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:728
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:2952
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:4280
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:1476
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies registry class
          PID:996
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4880
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:372
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3780
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:2644
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Modifies registry class
              PID:4304
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies registry class
              PID:4052
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4824
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies registry class
                PID:3048
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                PID:4480
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                PID:4252
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:2208
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:3788
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                PID:2412
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                PID:4140
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4316
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies registry class
                  PID:5076
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  PID:4944
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies registry class
                  PID:3004
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies registry class
                  PID:448
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies registry class
                  PID:3904
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies registry class
                  PID:2324
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  PID:3688
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  PID:4700
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies registry class
                  PID:228
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  PID:4184
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  PID:4668
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:1976
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:3692
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:4196
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:3796
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:1696
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:1944
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:2928
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3628
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Modifies registry class
                      PID:2040
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      PID:2336
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies registry class
                      PID:1080
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      PID:3696
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Modifies registry class
                      PID:4704
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      PID:5052
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:3852
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        PID:4120
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        PID:2848
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4496
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Modifies registry class
                          PID:3764
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Modifies registry class
                          PID:4908
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies registry class
                          PID:2772
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          PID:3672
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Modifies registry class
                          PID:2172
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies registry class
                          PID:3636
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4456
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4948
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Modifies registry class
                              PID:696
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies registry class
                              PID:4056
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              PID:2692
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3356
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:2824
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies registry class
                                PID:4884
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:920
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:4660
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:2348
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:3868
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:4484
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:3224
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:1624
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3052
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:2516
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3460
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies registry class
                                PID:852
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies registry class
                                PID:3576
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:4528
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3024
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Modifies registry class
                                PID:4476
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:1052
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:2916
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3204
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Modifies registry class
                                  PID:1936
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Modifies registry class
                                  PID:3356
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  PID:4168
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:2868
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:4408
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Boot or Logon Autostart Execution: Active Setup
                                      • Modifies registry class
                                      PID:1500
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Boot or Logon Autostart Execution: Active Setup
                                      PID:3100
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                      • Boot or Logon Autostart Execution: Active Setup
                                      • Modifies registry class
                                      PID:3136
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4972
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4384
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3736
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2520
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4200
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:5060
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4596
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3256
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:1592
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4640
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3240
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3544
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4232
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3548
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2724
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2568
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3848
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4600
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2952
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3768
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:1364
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2912
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:4796
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:1616
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:3896
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4968
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:5012
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4772
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:784
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:1632
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:2636
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:2440
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:5048
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:2728
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:5016
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2528
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:3428

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                Filesize

                                                                                                                471B

                                                                                                                MD5

                                                                                                                618f6dc0d63e9f881dc1107a7e56dbc7

                                                                                                                SHA1

                                                                                                                12534c7b00b40dc2ae76482c2a7bd8fad3329cd5

                                                                                                                SHA256

                                                                                                                b195d2c810c2db1349760500305f49e17ebeb47825aeaaf41e95bd11e2fdba86

                                                                                                                SHA512

                                                                                                                2c33661df07eaea6f9b24c53699fcaa0dc14e2c56f8b91766204a1cb7320c9fdc53c04f674ffb1e4d54c659ef2dc6406aa3a98d45d2f6416101161ab4a62a037

                                                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                Filesize

                                                                                                                420B

                                                                                                                MD5

                                                                                                                8d83fe09626e70c5c38945f29c08f903

                                                                                                                SHA1

                                                                                                                8845b3b86d3f4a5de7973599371af83ba1474553

                                                                                                                SHA256

                                                                                                                a561a36b4fdea7c3522f9eaafd7c0f26bcc8505430dbdbfe43c9224b1639b08b

                                                                                                                SHA512

                                                                                                                6891708199b39f0ad4aa570e0f5e49693fa1e9ced7fe4c79af468a8074076ce0c4094cfb5631c08c847430f6e94c3cebc5e739410b0df09c16b197c6cc1d3c1d

                                                                                                              • C:\Users\Admin\AppData\Local\IconCache.db

                                                                                                                Filesize

                                                                                                                17KB

                                                                                                                MD5

                                                                                                                e8f0e0bac32c10229bbc168d10614829

                                                                                                                SHA1

                                                                                                                1ce39fc279fdfe7af308b30231048c3bd3ab98b8

                                                                                                                SHA256

                                                                                                                881155b19e28d6ee27bf4f4d117d0e790ce568b67a75d0de401a0f8e8a393db3

                                                                                                                SHA512

                                                                                                                923355ec1b9d624eb9e3296b4465fc1551845257400dbdb2c1b536852ec3317108342235e52d624d8813efc006a0c4a5dba045bc2f58b38abe9e930cb930b82f

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                                                Filesize

                                                                                                                1022B

                                                                                                                MD5

                                                                                                                fbeb339bd3272d0ceeb1cb8798e3db19

                                                                                                                SHA1

                                                                                                                aa6c18c1d35e442098a98388c0fcd45850dbbc5f

                                                                                                                SHA256

                                                                                                                e3232b57e691a72d406d6774f56af8e5aea1921745efc460362ef7edc4a62998

                                                                                                                SHA512

                                                                                                                cc6eaaabfb3526d360c5807ef0ee0fb85f4b72f7d81805fccd57879afc4d2d792a458eb8f93f6674271fbe25a05b2e2c1046cdb14078cbb2109a1f9a533f1189

                                                                                                              • memory/676-23-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-26-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-13-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-2-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-1-0x00007FF97CE50000-0x00007FF97D045000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.0MB

                                                                                                              • memory/676-35-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-21-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-22-0x00007FF97CE50000-0x00007FF97D045000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.0MB

                                                                                                              • memory/676-0-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-24-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-25-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-34-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-27-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-28-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-29-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-30-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-31-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-32-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/676-33-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                Filesize

                                                                                                                6.2MB

                                                                                                              • memory/2288-8-0x00000000043C0000-0x00000000043C1000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB

                                                                                                              • memory/4376-17-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                Filesize

                                                                                                                4KB