Overview

overview

10

Static

static

3

217f44d1f0...18.exe

windows7-x64

10

217f44d1f0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    86s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 07:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    217f44d1f0cd384c2a17dc9dee153f78_JaffaCakes118.exe

  • Size

    275KB

  • MD5

    217f44d1f0cd384c2a17dc9dee153f78

  • SHA1

    d78df510b273cb3b49902680eb87b18ea343638a

  • SHA256

    3ce42b2e2fe2708e62e1ac79ab424f55550bc69a5886231d25a1c7ff6b769747

  • SHA512

    8a7a3b4a733d2bbabb19547edb9e1df74afd95c4d95bd8d60505403253e59e50e236c204c0b683915e87996091daef15cf12219a88e71bc0f14ae3154d5ec591

  • SSDEEP

    6144:ZSYXnR3qfv+Ctu3iFCh/mCYSIWtgeAEOlJUuONGhmdTNY:ZSYhiV6iFC5rpVdOlSFcmZ

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\217f44d1f0cd384c2a17dc9dee153f78_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\217f44d1f0cd384c2a17dc9dee153f78_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3564
    • C:\Users\Admin\AppData\Local\Temp\217f44d1f0cd384c2a17dc9dee153f78_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\217f44d1f0cd384c2a17dc9dee153f78_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\5902E\05B72.exe%C:\Users\Admin\AppData\Roaming\5902E
      2⤵
        PID:1188
      • C:\Program Files (x86)\LP\7285\D282.tmp
        "C:\Program Files (x86)\LP\7285\D282.tmp"
        2⤵
        • Executes dropped EXE
        PID:2280
      • C:\Users\Admin\AppData\Local\Temp\217f44d1f0cd384c2a17dc9dee153f78_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\217f44d1f0cd384c2a17dc9dee153f78_JaffaCakes118.exe startC:\Program Files (x86)\2EAA4\lvvm.exe%C:\Program Files (x86)\2EAA4
        2⤵
          PID:2784
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1908
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4572
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4180
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3656
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3876
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4660
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4476
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2656
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:4300
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3856
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4032
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2976
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3692
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4648
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4000
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3592
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3892
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3588
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2428
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4724
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3416
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4032
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3596
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1608
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4872
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4536
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3592
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3828
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4584
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4436
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5048
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3552
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4216
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3600
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2104
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:2068
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:2320
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4816
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3892
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4872
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4740
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4952
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:2176
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:1388
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:4148
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3716
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2792
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3640
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3600
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:5096
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:4312
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4360
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2256

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Program Files (x86)\LP\7285\D282.tmp
                                                    Filesize

                                                    98KB

                                                    MD5

                                                    7f6425e2daee78b405b6034752c71f3e

                                                    SHA1

                                                    5294632d49d260f2ee7d8d3998ad53a2c788d58e

                                                    SHA256

                                                    b72374acd6be4eb03ae0bb3dfedb36431bd8300085a72eaddbae9577cc8b1cd2

                                                    SHA512

                                                    5546bdb4c525cbc4e98e77400f600e46209cc12ebce6bc54292950924be7e90533dba3c37fd3eefe0777fa4d586b584e30ac8585367fe1c02fabf3f21a4fab8c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    606c9a51e63ab319a840314c49edbcb3

                                                    SHA1

                                                    6072f2cfcfd576fe7d031f6cc9ac21eadbf6e1a5

                                                    SHA256

                                                    26e944d4b43c456cfec447bba7afcbd1afc313f3aac7cedea56c123d7de60cb0

                                                    SHA512

                                                    d8d771f4379b01cd220e34ce0a177d11783c44d6ac225577f6c9dd4a22d8a94463c5ed7668b3ded31a7e1bed7f27d51390159ad1e4bf0941b02d70afc99cec06

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
                                                    Filesize

                                                    36KB

                                                    MD5

                                                    8aaad0f4eb7d3c65f81c6e6b496ba889

                                                    SHA1

                                                    231237a501b9433c292991e4ec200b25c1589050

                                                    SHA256

                                                    813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                    SHA512

                                                    1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe
                                                    Filesize

                                                    36KB

                                                    MD5

                                                    f6a5ffe5754175d3603c3a77dcfeca6b

                                                    SHA1

                                                    dacd500aeef9dd69b87feae7521899040e7df1d9

                                                    SHA256

                                                    fab3529f4a4df98271fa2f6a7860a28fdc30215144b7eefbaf6d424a2847d035

                                                    SHA512

                                                    66ec46041f1fe20203cda7a4d68b61d2e5bcdd09a36ee8171efa53fe92a9e6e023c5a254a4c43c110a99749829d7b99613f8d13dfb4c42656097cb8d224a531e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133644644718801166.txt
                                                    Filesize

                                                    75KB

                                                    MD5

                                                    79ea60e4feeffe4483ba2d0ea61852fb

                                                    SHA1

                                                    7d5921a1b6240cc717ad4f4478bbcfc42f3af8e8

                                                    SHA256

                                                    1e85f6cd486b20682b1a6af9f34e7993a558f3b5dccd1e80a55178847e794923

                                                    SHA512

                                                    4d0866c2b63af9570fa20bca628a6e67b3704d7ab5a8a1311fb614f38b54444cc6630390092282f075751cae38000a17e4bf1cb992a8900b0c72965c0b24dbf4

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9WOT0LPI\microsoft.windows[1].xml
                                                    Filesize

                                                    96B

                                                    MD5

                                                    589e139869250cac3aaf7cb946d415ab

                                                    SHA1

                                                    71b4b736779c2716ee9ce5b2892cbc4edec40ee8

                                                    SHA256

                                                    60f8214fb3bed025a0239c2d15501db6f669215d8d09371a285568ed5c5bad26

                                                    SHA512

                                                    0877e0c5a806bffe678a27fbef67b128723f886bf0ea7a8fe82d4c57de61a78efdb36604c0296ab643e4674caff3d0def6fc4b3c9efbd27332fa5729414a2632

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\5902E\EAA4.902
                                                    Filesize

                                                    600B

                                                    MD5

                                                    13c5cc30f6c5922e7d00631efa92269a

                                                    SHA1

                                                    e9bc64f12b5a1d24dd757edc11fca93b6686d1f2

                                                    SHA256

                                                    4f74435f5995d982b27438313911ff8cd9159908b214ce593ec022451e12ab51

                                                    SHA512

                                                    ada6faafdcee249353198c87547ef4a975ee8ddcc484c9a091d96b44c399b198d394b8da5c42dd4e795b5800aa219cdca4b7fc262b35ee90977e69db8e9f7e0d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\5902E\EAA4.902
                                                    Filesize

                                                    897B

                                                    MD5

                                                    f727bf0adae660c7987892319ad77e9a

                                                    SHA1

                                                    dffae2239fda617941864a2cf195d869197dafec

                                                    SHA256

                                                    27e9d895fff9e9f17cc81b2cb1aa28a0cbe861aab0ac1858ab2cf5808ba8a1b8

                                                    SHA512

                                                    005a33133d253b28b8bb221898387cb9ca254e335837d17826cedc67dd20ec2fa2a0a26996db7e78ca7826c25eab26237319a1b37178cefedc1c351aeb66a9bd

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\5902E\EAA4.902
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    96d4337f93dc6ade4c5659cad0cc7be0

                                                    SHA1

                                                    30e3150393f544c7ab48a7e723e64d23a41eba4e

                                                    SHA256

                                                    64a15b08f26469eb6b99bf0ce41675f53d148b8b85b5291fb1bfaecf7ecfe22c

                                                    SHA512

                                                    3233e7ca1073b7cc9c5792e14153c3a38e93a38a88ae0d996fa814d8ec64bf82ed963e2e6d5b698fd84eb75ec8012c91ae9fd77580827d9a50d36058eff17609

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\5902E\EAA4.902
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    d27983298974583862c3ce23cb9f31f1

                                                    SHA1

                                                    91f4957bacaf9a118f7dc122b08f7fc27403a820

                                                    SHA256

                                                    6c79ca6d6e95483ead49277cb48401740cfbfea84b84691290f55fa8af8478fd

                                                    SHA512

                                                    8e0a90ec2799e18fb9bb52a074ccedc1e052ff2093a2c20c9af3f304a4381429cccfe6ffd7adcac59e13287f7a6104320e32910e84c545bfbd07b87badd0bca7

                                                    Download Submit

                                                  • memory/1188-197-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/1608-1062-0x0000019807A40000-0x0000019807A60000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1608-1058-0x0000019806A00000-0x0000019806B00000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/1608-1072-0x0000019807A00000-0x0000019807A20000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/1608-1094-0x0000019807E10000-0x0000019807E30000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2280-625-0x0000000000400000-0x000000000041C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/2428-908-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2656-234-0x000002393B050000-0x000002393B150000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/2656-235-0x000002393B050000-0x000002393B150000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/2656-238-0x000002393BDB0000-0x000002393BDD0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2656-264-0x000002393C580000-0x000002393C5A0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2656-250-0x000002393BD70000-0x000002393BD90000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/2656-233-0x000002393B050000-0x000002393B150000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/2784-623-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3416-946-0x000002145C6F0000-0x000002145C710000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3416-911-0x000002145B200000-0x000002145B300000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3416-928-0x000002145BFE0000-0x000002145C000000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3416-910-0x000002145B200000-0x000002145B300000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3416-914-0x000002145C320000-0x000002145C340000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3564-626-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3564-905-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3564-2-0x0000000000400000-0x0000000000467000-memory.dmp

                                                    Filesize

                                                    412KB

                                                    Download

                                                  • memory/3564-3-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3564-230-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3564-0-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3564-4-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3564-83-0x0000000000400000-0x0000000000467000-memory.dmp

                                                    Filesize

                                                    412KB

                                                    Download

                                                  • memory/3564-84-0x0000000000400000-0x000000000046A000-memory.dmp

                                                    Filesize

                                                    424KB

                                                    Download

                                                  • memory/3656-79-0x0000000002B30000-0x0000000002B31000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/3876-96-0x0000026523E80000-0x0000026523EA0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3876-80-0x0000026522F60000-0x0000026523060000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/3876-87-0x0000026523EC0000-0x0000026523EE0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3876-108-0x00000265244A0000-0x00000265244C0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/3892-750-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4000-765-0x0000022C65100000-0x0000022C65120000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4000-797-0x0000022C654D0000-0x0000022C654F0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4000-778-0x0000022C650C0000-0x0000022C650E0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4032-512-0x000001EF0A900000-0x000001EF0AA00000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4032-1056-0x00000000042F0000-0x00000000042F1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4032-513-0x000001EF0A900000-0x000001EF0AA00000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4032-511-0x000001EF0A900000-0x000001EF0AA00000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4032-516-0x000001EF0BC00000-0x000001EF0BC20000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4032-540-0x000001EF0BFC0000-0x000001EF0BFE0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4032-528-0x000001EF0B9B0000-0x000001EF0B9D0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4300-510-0x00000000045E0000-0x00000000045E1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4536-1183-0x000002496F2C0000-0x000002496F2E0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4536-1207-0x000002496F8A0000-0x000002496F8C0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4536-1178-0x000002496E360000-0x000002496E460000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                    Download

                                                  • memory/4536-1195-0x000002496F280000-0x000002496F2A0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/4584-1324-0x0000000004490000-0x0000000004491000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4660-231-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4872-1176-0x0000000003290000-0x0000000003291000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/5048-1331-0x000001AB337C0000-0x000001AB337E0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/5048-1349-0x000001AB33B90000-0x000001AB33BB0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download

                                                  • memory/5048-1338-0x000001AB33780000-0x000001AB337A0000-memory.dmp

                                                    Filesize

                                                    128KB

                                                    Download