Overview

overview

8

Static

static

3

76091586cb...18.exe

windows7-x64

8

76091586cb...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    23s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 22:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe

  • Size

    643KB

  • MD5

    76091586cb13cdfc5f1105790ba0a554

  • SHA1

    81830446c6152c78899ade0e021babb4df72a8a7

  • SHA256

    3809fe103d067172f6c16d58db37b4e273f3780db8a626a19fc737f40fd00d7c

  • SHA512

    4aa151214f0246a416672d8525899e1aa0b4614b2dd15eaf5b1e33f24466bb262d5fab98be6db09d8ef02767fbdfbf9da9566aa9eb21d4e3620e29729dc57dee

  • SSDEEP

    12288:MT5Hn+UaFdwoDEg2m9GQewuGdCXK1kU9hyTU6O2wsJ8QVAfZ+:In+UaFdwogg24GQKAhV6O2wsy

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 61 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\76091586cb13cdfc5f1105790ba0a554_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3276
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3992
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2784
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4336
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4228
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1224
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2272
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:452
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4384
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2232
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:1456
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3232
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2272
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1080
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:2332
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:2712
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3876
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:2268
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:2164
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4236
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:1364
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:2480
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:3620
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3336
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3716
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:1440
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:1580
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4188
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:3644
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3736
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4684
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3760
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4552
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:3024
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2848
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3760
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4372
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4092
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4844
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:4280
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4500
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:900
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3620
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:2088
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1144
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:2524
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:3464
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:2224
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:4720
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3080
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                    1⤵
                                                                                      PID:1020
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                        PID:4500
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:4412
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                          1⤵
                                                                                            PID:2108
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                            1⤵
                                                                                              PID:4472
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3320
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                1⤵
                                                                                                  PID:4032
                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                  1⤵
                                                                                                    PID:3644
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:4544
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                        PID:4672
                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                        1⤵
                                                                                                          PID:3332
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:744
                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                            1⤵
                                                                                                              PID:4796
                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                              1⤵
                                                                                                                PID:3884
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:352
                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                  1⤵
                                                                                                                    PID:3212
                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                    1⤵
                                                                                                                      PID:2548
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:1428
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                          PID:3076
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                          1⤵
                                                                                                                            PID:2616
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:2764
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                              1⤵
                                                                                                                                PID:1260
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                1⤵
                                                                                                                                  PID:4336
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4868
                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                    1⤵
                                                                                                                                      PID:1244
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:5004
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:4540
                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                          1⤵
                                                                                                                                            PID:1984
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                            1⤵
                                                                                                                                              PID:4968

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                              Filesize

                                                                                                                                              471B

                                                                                                                                              MD5

                                                                                                                                              d939a39ea46c39449434b928f546e513

                                                                                                                                              SHA1

                                                                                                                                              fa61eeaaa498b412359a026e8bc7bb86cea3b1fb

                                                                                                                                              SHA256

                                                                                                                                              9ece5a85b7e73ad5331d742370ee0e282ef3c862318488b85dc9c66826961515

                                                                                                                                              SHA512

                                                                                                                                              285b14114f0214eb2959ce405d31764e86216758c90c056113fdb39399af01fd4053ca80ab24f3af936fc3e19066eb11c64c4ceff7a689249e5d013d908bd639

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                              Filesize

                                                                                                                                              420B

                                                                                                                                              MD5

                                                                                                                                              16599a8f02e87662bf32785b66cb9c09

                                                                                                                                              SHA1

                                                                                                                                              807a2698ea1152d4e8c5bd0678ede9fe309f6937

                                                                                                                                              SHA256

                                                                                                                                              aecbca0e24696040aa61f584568414b9d67d91e44c24138600797ad9e1a7db52

                                                                                                                                              SHA512

                                                                                                                                              d50fa4d20256342000ea75abd524ae61afcd250364e6a8e6a628e5914580a78236bd5cdcc6322cf61d540f13765a0d6b5ce795e599264c63b4a2314a32d3e8ea

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              7c148d3a54a8c82625df0abb966f589d

                                                                                                                                              SHA1

                                                                                                                                              c0b7e5ddfe7b47a1585555ca9ae9ab79314b67c8

                                                                                                                                              SHA256

                                                                                                                                              877663988f410a7b198376e5e4038a3721f7c77adda283f5de36af563702db1a

                                                                                                                                              SHA512

                                                                                                                                              f07c16065c7a75769eaa3eb0b7bc22ec8472f4829f7b06d672f26c1aa2e0a1e7118ff257ce93f91e114f5dede8cee8824339293045a4c27b9a8c60ac19c545e7

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133665754470997310.txt
                                                                                                                                              Filesize

                                                                                                                                              75KB

                                                                                                                                              MD5

                                                                                                                                              1446ea2b153d65a819e9bbf4d4e5c4ee

                                                                                                                                              SHA1

                                                                                                                                              9947842974e8df5f396674d1ba50623ca9d41289

                                                                                                                                              SHA256

                                                                                                                                              d5bff7962185922941cb2e88950ea716b03159f7cb42363f2f2427a059db7a28

                                                                                                                                              SHA512

                                                                                                                                              6026f08924c4a8bbbc219190d1d77cd8f94508b431fae39d7ccd2203fd9515f7340f56952fe9ea806e66f1c533e7b9b1cc82c5693e89dd96bf805100e238a301

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7M5I75JN\microsoft.windows[1].xml
                                                                                                                                              Filesize

                                                                                                                                              97B

                                                                                                                                              MD5

                                                                                                                                              859ab69c110b39b89cf12fa8ec848a60

                                                                                                                                              SHA1

                                                                                                                                              115751d92448bb0fd75a162938226fb6b0b30ede

                                                                                                                                              SHA256

                                                                                                                                              a8feaf799158198356b15e70ab778bfaa95fc80817477d15e355e67a6efc7c5a

                                                                                                                                              SHA512

                                                                                                                                              6ee7e9cd4d7e53ff6f31eba404a1782a9a0fe524b5aefb3fbf556d56fb70cd036204dd4b46bd87aec3ecd165f4bcfc10742d9cce6665b9e90a4f96723831c989

                                                                                                                                              Download Submit

                                                                                                                                            • memory/452-54-0x000001F5EB350000-0x000001F5EB370000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/452-38-0x000001F5EAF40000-0x000001F5EAF60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/452-20-0x000001EDE8E20000-0x000001EDE8F20000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/452-24-0x000001F5EAF80000-0x000001F5EAFA0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-343-0x0000029E66E00000-0x0000029E66F00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-367-0x0000029E67F20000-0x0000029E67F40000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-379-0x0000029E68330000-0x0000029E68350000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-348-0x0000029E67F60000-0x0000029E67F80000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1080-344-0x0000029E66E00000-0x0000029E66F00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/1224-18-0x00000000031B0000-0x00000000031B1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/1364-785-0x00000000042F0000-0x00000000042F1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/1440-941-0x000001F8F8B20000-0x000001F8F8B40000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1440-964-0x000001F8F8F30000-0x000001F8F8F50000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1440-933-0x000001F8F8B60000-0x000001F8F8B80000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1456-217-0x00000214F2100000-0x00000214F2120000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1456-192-0x00000214F0C00000-0x00000214F0D00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/1456-205-0x00000214F1AF0000-0x00000214F1B10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1456-191-0x00000214F0C00000-0x00000214F0D00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/1456-193-0x00000214F0C00000-0x00000214F0D00000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/1456-196-0x00000214F1B30000-0x00000214F1B50000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-485-0x0000000014170000-0x0000000014311000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-2-0x0000000000600000-0x0000000000601000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-340-0x0000000000600000-0x0000000000601000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-338-0x00000000005A0000-0x00000000005A2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-1224-0x0000000014170000-0x0000000014311000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-752-0x0000000014170000-0x0000000014311000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-1-0x00000000005A0000-0x00000000005A2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-0-0x0000000014170000-0x0000000014311000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-186-0x0000000014170000-0x0000000014311000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-7-0x0000000014170000-0x0000000014311000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/1460-924-0x0000000014170000-0x0000000014311000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/1580-1073-0x0000000004E00000-0x0000000004E01000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2268-632-0x0000000004F20000-0x0000000004F21000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2332-487-0x0000000004280000-0x0000000004281000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3232-341-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3336-926-0x0000000004490000-0x0000000004491000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3620-792-0x000002AE2B5B0000-0x000002AE2B5D0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3620-788-0x000002AE2A450000-0x000002AE2A550000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3620-787-0x000002AE2A450000-0x000002AE2A550000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3620-802-0x000002AE2B570000-0x000002AE2B590000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3620-824-0x000002AE2B980000-0x000002AE2B9A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3644-1075-0x000002BD74000000-0x000002BD74100000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3644-1111-0x000002BD74EB0000-0x000002BD74ED0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3644-1112-0x000002BD754C0000-0x000002BD754E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3644-1080-0x000002BD74EF0000-0x000002BD74F10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3736-1226-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/3760-1234-0x000001A7861E0000-0x000001A786200000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3760-1229-0x000001A785400000-0x000001A785500000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3760-1228-0x000001A785400000-0x000001A785500000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3876-490-0x000002A2C9F20000-0x000002A2CA020000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3876-494-0x000002A2CB270000-0x000002A2CB290000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3876-491-0x000002A2C9F20000-0x000002A2CA020000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3876-489-0x000002A2C9F20000-0x000002A2CA020000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/3876-502-0x000002A2CB230000-0x000002A2CB250000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/3876-516-0x000002A2CB640000-0x000002A2CB660000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4236-639-0x00000221052E0000-0x0000022105300000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4236-635-0x0000022104500000-0x0000022104600000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/4236-634-0x0000022104500000-0x0000022104600000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1024KB

                                                                                                                                              Download

                                                                                                                                            • memory/4236-652-0x00000221052A0000-0x00000221052C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4236-669-0x00000221058C0000-0x00000221058E0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              128KB

                                                                                                                                              Download

                                                                                                                                            • memory/4384-189-0x00000000042C0000-0x00000000042C1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download