Analysis

  • max time kernel
    77s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 04:07

General

  • Target

    5a66e6b58eb92c0ee41737ac6f22a9b7_JaffaCakes118.exe

  • Size

    914KB

  • MD5

    5a66e6b58eb92c0ee41737ac6f22a9b7

  • SHA1

    c30ae7928eb711884f887059429fa740d8eb7e34

  • SHA256

    44b94ac3e28aa1ee350a36a2ad7e5b7d3ed9fde5d881bae6c5a02eb5d77bdccb

  • SHA512

    1e004c3d3fb61f6ff9a12dc80fcad496ae7060ffaa73b38e0cbbddb030870500a685eec7ba2a2308580d401757c0ee1a01ae5a99e90dd19ec5fa52f2ce6a669d

  • SSDEEP

    24576:dWMCW6/87Zrrh+xEb02ToBWGIIVFZLUhkJ+GZg:dIWXZ3/g/rxohnGZg

Score
8/10

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 45 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a66e6b58eb92c0ee41737ac6f22a9b7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5a66e6b58eb92c0ee41737ac6f22a9b7_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 912
        3⤵
        • Program crash
        PID:4380
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 948
        3⤵
        • Program crash
        PID:4448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1100
        3⤵
        • Program crash
        PID:964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1172
        3⤵
        • Program crash
        PID:3400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1212
        3⤵
        • Program crash
        PID:4100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1220
        3⤵
        • Program crash
        PID:4952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1316
        3⤵
        • Program crash
        PID:3016
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1316
        3⤵
        • Program crash
        PID:5004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1376
        3⤵
        • Program crash
        PID:2736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1800
        3⤵
        • Program crash
        PID:3112
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 2008
        3⤵
        • Program crash
        PID:1364
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1288
        3⤵
        • Program crash
        PID:3632
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1448 -ip 1448
    1⤵
      PID:2160
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1448 -ip 1448
      1⤵
        PID:1660
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1448 -ip 1448
        1⤵
          PID:4164
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1448 -ip 1448
          1⤵
            PID:3268
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1448 -ip 1448
            1⤵
              PID:4008
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1448 -ip 1448
              1⤵
                PID:2108
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1448 -ip 1448
                1⤵
                  PID:4768
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1448 -ip 1448
                  1⤵
                    PID:1140
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1448 -ip 1448
                    1⤵
                      PID:2680
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4348
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:880
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4592
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:2164
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4812
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SendNotifyMessage
                        PID:1508
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:3960
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4196
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:2228
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:3220
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:2556
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:2744
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3764
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:2344
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3128
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Modifies registry class
                            PID:4900
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                          1⤵
                            PID:3844
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4400
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                                PID:4088
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:3904
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:4712
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:220
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3008
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3712
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:4844
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:4448
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:536
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:3948
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:1820
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:4888
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:3268
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3132
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:2364
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:4128
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:4136
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:2860
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:1256
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:916
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:1068
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3528
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:1072
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:2616
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:3400
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:1880
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:2080
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                PID:3100
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:2412
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:1548
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:1808
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                • Boot or Logon Autostart Execution: Active Setup
                                • Modifies registry class
                                PID:2192
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1448 -ip 1448
                                1⤵
                                  PID:1656
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                  • Boot or Logon Autostart Execution: Active Setup
                                  • Modifies registry class
                                  PID:3312
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1448 -ip 1448
                                  1⤵
                                    PID:1440
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:3748
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:1784
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:388
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:3816
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:3636
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:5076
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:2828
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:844
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Modifies registry class
                                    PID:3932
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2440
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:1376
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:3780
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2372
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2444
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:2136
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2340
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:624
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4052
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4852
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:932
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:3672
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:2132
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4664
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3560
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4816
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3116
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:320
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3828
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:656
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4828
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4584
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3992
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:2772
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:224
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:2032
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2584
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:1608
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:3080
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:2824
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:848
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:1672
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:2956
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3912
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:1460
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1448 -ip 1448
                                                                                                          1⤵
                                                                                                            PID:3324
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:1924
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:3004
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:376
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:2332
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:3844
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:2056
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:1888
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:2456
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:5044
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:4616
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:4296
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:928
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:3628
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1984
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:5092
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1732

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\ProgramData\isecurity.exe

                                                                                                                                                  Filesize

                                                                                                                                                  860KB

                                                                                                                                                  MD5

                                                                                                                                                  e9839b427dc39ff93b167f7cb44e00c7

                                                                                                                                                  SHA1

                                                                                                                                                  228c8926ab08a0a0a0e70934a62e80056b471f2d

                                                                                                                                                  SHA256

                                                                                                                                                  d8644d3f975716ab0960859a85796ca91528ddb2c9e85df410a47af82bf10757

                                                                                                                                                  SHA512

                                                                                                                                                  221a2e46e40ab837c7f5dadca73828ab86ff514b98bd52993624ea670acf88f0870c1c3445097a9c51af918f44c9bb8d30442e8ee27d385fed1e03ff8f3b466f

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                                                  Filesize

                                                                                                                                                  471B

                                                                                                                                                  MD5

                                                                                                                                                  5a26f75f014290d1b720b5ccd4fe9249

                                                                                                                                                  SHA1

                                                                                                                                                  6e1de26b8bbe7f990f5520f81517c971fb9af2c7

                                                                                                                                                  SHA256

                                                                                                                                                  0282961a16376a3885c3927c3b99460aa45187b0f2ef48abf405f40e6fe66207

                                                                                                                                                  SHA512

                                                                                                                                                  3d39f51ddecd97c42d0d92ca7e32193288629157dcf362a57241c240904eae5221c943dc0ab3cac986bb58cab7c1e40889ad11c4893265a6c298872e8301b855

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                                                                  Filesize

                                                                                                                                                  420B

                                                                                                                                                  MD5

                                                                                                                                                  2abbcb3f4afd27bf590ced48a7a738fb

                                                                                                                                                  SHA1

                                                                                                                                                  fa6bbf21828859333b9701504f45adc4088d9652

                                                                                                                                                  SHA256

                                                                                                                                                  a55eb698ae9e0e37900303870b2bfecffa9cc13d74718ed4387f1041143c0019

                                                                                                                                                  SHA512

                                                                                                                                                  16a8e0cf9966e1ab768a16e0809a3505d97261fe1fa26c2af399d8deb0c07de249d592f4e049000a0d6b96480266381992492a64bd914d8de7b0d8e074bf581f

                                                                                                                                                • C:\Users\Admin\AppData\Local\IconCache.db

                                                                                                                                                  Filesize

                                                                                                                                                  15KB

                                                                                                                                                  MD5

                                                                                                                                                  7190997dfeeb18add86ddb92eef0a40a

                                                                                                                                                  SHA1

                                                                                                                                                  b5f8dec684e1915e567966b6174653966c7d7e98

                                                                                                                                                  SHA256

                                                                                                                                                  e0099f7d469817ba8455e23b13333239d40c0e862f8cb47af64f2bfb33bfe4fb

                                                                                                                                                  SHA512

                                                                                                                                                  ec3f38209b057f4ab82a4a48337d36a9ec6553f1d65092cf1d36a607e292594452fdee21b62bd74d67288e03a051e81aa95a6b040c46b2ec7ac558a1bcd6d15b

                                                                                                                                                • C:\Users\Admin\AppData\Local\IconCache.db

                                                                                                                                                  Filesize

                                                                                                                                                  18KB

                                                                                                                                                  MD5

                                                                                                                                                  0a200b041d395ba5827609eb95b79525

                                                                                                                                                  SHA1

                                                                                                                                                  f18d783874baf082d57de7a7efc5e0b884a767b2

                                                                                                                                                  SHA256

                                                                                                                                                  54802f4752dad99cabdfc87f43edfbf48306559e4477f390853de003056bbe6f

                                                                                                                                                  SHA512

                                                                                                                                                  57e1dd631bb81e90593d4860badf33ff7cd7c86d9d0bb648a9b134eb4eba94b185ae202cb6bbbae9f3ce82338070432c9afeaa710c9bb2a1619c10bd9d605599

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                                                                                  Filesize

                                                                                                                                                  1022B

                                                                                                                                                  MD5

                                                                                                                                                  fd224e1df7aa1f56fa4ebee057693d16

                                                                                                                                                  SHA1

                                                                                                                                                  11a4909fd843066b58f5cd4784a2ac4b8c29b549

                                                                                                                                                  SHA256

                                                                                                                                                  947eda0908b601189f883d8067eb9e164d671aeba9a9145a01e74636b6a9ec2c

                                                                                                                                                  SHA512

                                                                                                                                                  e1084a9e54e1f6203d845b4743a5febb876cb7cce5f645ba7b0fdbfe2a5d29a7e8d5f2783cef314c08a293ebeff722e83510d5acb5cc04fe7ef0b59a2f49cae1

                                                                                                                                                • C:\Users\Public\Desktop\Internet Security.lnk

                                                                                                                                                  Filesize

                                                                                                                                                  682B

                                                                                                                                                  MD5

                                                                                                                                                  17a96169046ea6c44faeea875af194b8

                                                                                                                                                  SHA1

                                                                                                                                                  e678dbe6c9c457abfe57c57607cdb5e29ca6dee1

                                                                                                                                                  SHA256

                                                                                                                                                  b37e02d8133964702a98485c567bbcd02afe61aaf49b3a7678dfe8b519efbeb4

                                                                                                                                                  SHA512

                                                                                                                                                  a50e46838b5f5dfb463c512a4d4308ce409297773334a42cf8f0740941bbd3bb1dee51a89c0a297424d5565152915eeba5ddbc912facfaf6e177bb64d765009c

                                                                                                                                                • memory/880-27-0x0000000002950000-0x0000000002951000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/1448-53-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-56-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-20-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-18-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-17-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-30-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-15-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-14-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-63-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-62-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-61-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-60-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-41-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-59-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-48-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-49-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-50-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-51-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-52-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-58-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-54-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-55-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-19-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/1448-57-0x0000000000400000-0x0000000000A3C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/2344-43-0x00000000045A0000-0x00000000045A1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/3220-36-0x0000000004570000-0x0000000004571000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/4876-1-0x0000000000400000-0x000000000051F000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                • memory/4876-0-0x00000000004FF000-0x0000000000501000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4876-2-0x0000000000400000-0x000000000051F000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                • memory/4876-7-0x0000000000400000-0x000000000051F000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB