Analysis
-
max time kernel
68s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2024 00:45
Behavioral task
behavioral1
Sample
d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
35 signatures
150 seconds
Behavioral task
behavioral2
Sample
d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
34 signatures
150 seconds
General
-
Target
d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe
-
Size
937KB
-
MD5
d563e2f9a8d5d5c74c62eb533e90dd70
-
SHA1
2a7a97ad4a427eb693fa9abb7347fd9f3ef997ea
-
SHA256
15451e3138817bd4cf423ac5e4864b01c20cce445c7355f7531adc586c5e1475
-
SHA512
6165b16827c10948537783d6ec36267d66a4211f7e7d7521a8c7c9bb3f831c950d65f4becf110d76bc2f6f8ca7fd7779e600761fa8f1d2e8cf084e2fa2965910
-
SSDEEP
24576:QeWv89tDzQQZIs2EfAzITVdAvbJpXPP/6JMNRnk844M7L9tZt:QeWvWQQr2E4SdWPCyHkD4M3DZt
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" cxhost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ce4Rf7.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qeepio.exe -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
ModiLoader Second Stage 10 IoCs
resource yara_rule behavioral2/memory/2872-5-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/1708-7-0x0000000000400000-0x0000000000541000-memory.dmp modiloader_stage2 behavioral2/memory/1708-6-0x0000000000400000-0x0000000000541000-memory.dmp modiloader_stage2 behavioral2/files/0x000a00000002343d-51.dat modiloader_stage2 behavioral2/memory/3484-57-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/1708-61-0x0000000000400000-0x0000000000541000-memory.dmp modiloader_stage2 behavioral2/files/0x0007000000023502-63.dat modiloader_stage2 behavioral2/memory/2748-73-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/files/0x00120000000218f3-1076.dat modiloader_stage2 behavioral2/memory/1708-1205-0x0000000000400000-0x0000000000541000-memory.dmp modiloader_stage2 -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation ce4Rf7.exe -
Executes dropped EXE 12 IoCs
pid Process 2476 ce4Rf7.exe 8 qeepio.exe 3484 axhost.exe 876 axhost.exe 2748 bxhost.exe 2104 bxhost.exe 4456 cxhost.exe 2536 dxhost.exe 336 cxhost.exe 4972 cxhost.exe 3708 exhost.exe 2964 71B0.tmp -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1708-0-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1708-4-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1708-1-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1708-7-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/1708-6-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/876-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/876-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/876-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/876-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1708-61-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/876-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4456-93-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/336-95-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4456-200-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4972-202-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/4456-584-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral2/memory/3980-1198-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1708-1205-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/3980-1324-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 45 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /V" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /I" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /d" ce4Rf7.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /b" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /w" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /C" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /M" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /v" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /p" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /s" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /l" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /g" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /O" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /f" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /i" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /e" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /h" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /T" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /j" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /k" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /Y" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /A" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /n" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /U" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /E" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /c" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /z" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /W" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /y" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /F" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /S" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /G" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /Z" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /t" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /u" qeepio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\722.exe = "C:\\Program Files (x86)\\LP\\F507\\722.exe" cxhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /L" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /X" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /Q" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /P" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /K" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /q" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /H" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /R" qeepio.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qeepio = "C:\\Users\\Admin\\qeepio.exe /o" qeepio.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bxhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 bxhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum axhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 axhost.exe -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 4592 tasklist.exe 2476 tasklist.exe 4584 tasklist.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2872 set thread context of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 3484 set thread context of 876 3484 axhost.exe 101 PID 2748 set thread context of 2104 2748 bxhost.exe 103 -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\F507\722.exe cxhost.exe File opened for modification C:\Program Files (x86)\LP\F507\71B0.tmp cxhost.exe File created C:\Program Files (x86)\LP\F507\722.exe cxhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cxhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cxhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qeepio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cxhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ce4Rf7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxhost.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{DC461561-5216-4BF6-8BEF-5F3CF9D16C7B} explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{4848731A-90CB-4381-8455-D1F0A5DC71FF} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{10CB7C8A-47CA-4420-9342-3DD9A5593391} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{9B653063-8677-45AB-B87D-5DB4303CF4F2} explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2476 ce4Rf7.exe 2476 ce4Rf7.exe 2476 ce4Rf7.exe 2476 ce4Rf7.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 876 axhost.exe 876 axhost.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 2104 bxhost.exe 2104 bxhost.exe 8 qeepio.exe 8 qeepio.exe 2104 bxhost.exe 2104 bxhost.exe 2104 bxhost.exe 2104 bxhost.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 8 qeepio.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 4456 cxhost.exe 8 qeepio.exe 8 qeepio.exe 2104 bxhost.exe 2104 bxhost.exe 2104 bxhost.exe 2104 bxhost.exe 8 qeepio.exe 8 qeepio.exe 3992 X 3992 X -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4592 tasklist.exe Token: SeSecurityPrivilege 4788 msiexec.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 448 explorer.exe Token: SeCreatePagefilePrivilege 448 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4352 explorer.exe Token: SeCreatePagefilePrivilege 4352 explorer.exe Token: SeShutdownPrivilege 4808 explorer.exe Token: SeCreatePagefilePrivilege 4808 explorer.exe Token: SeShutdownPrivilege 4808 explorer.exe Token: SeCreatePagefilePrivilege 4808 explorer.exe Token: SeShutdownPrivilege 4808 explorer.exe Token: SeCreatePagefilePrivilege 4808 explorer.exe Token: SeShutdownPrivilege 4808 explorer.exe Token: SeCreatePagefilePrivilege 4808 explorer.exe Token: SeShutdownPrivilege 4808 explorer.exe Token: SeCreatePagefilePrivilege 4808 explorer.exe Token: SeShutdownPrivilege 4808 explorer.exe Token: SeCreatePagefilePrivilege 4808 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 448 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4352 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 2476 ce4Rf7.exe 8 qeepio.exe 4852 StartMenuExperienceHost.exe 3708 exhost.exe 3544 StartMenuExperienceHost.exe 3924 StartMenuExperienceHost.exe 5008 SearchApp.exe 3504 StartMenuExperienceHost.exe 2040 SearchApp.exe 4424 StartMenuExperienceHost.exe 2188 SearchApp.exe 4100 StartMenuExperienceHost.exe 4116 SearchApp.exe 5052 StartMenuExperienceHost.exe 1664 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 2872 wrote to memory of 1708 2872 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 87 PID 1708 wrote to memory of 2476 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 90 PID 1708 wrote to memory of 2476 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 90 PID 1708 wrote to memory of 2476 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 90 PID 2476 wrote to memory of 8 2476 ce4Rf7.exe 94 PID 2476 wrote to memory of 8 2476 ce4Rf7.exe 94 PID 2476 wrote to memory of 8 2476 ce4Rf7.exe 94 PID 2476 wrote to memory of 1140 2476 ce4Rf7.exe 95 PID 2476 wrote to memory of 1140 2476 ce4Rf7.exe 95 PID 2476 wrote to memory of 1140 2476 ce4Rf7.exe 95 PID 1140 wrote to memory of 4592 1140 cmd.exe 97 PID 1140 wrote to memory of 4592 1140 cmd.exe 97 PID 1140 wrote to memory of 4592 1140 cmd.exe 97 PID 1708 wrote to memory of 3484 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 98 PID 1708 wrote to memory of 3484 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 98 PID 1708 wrote to memory of 3484 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 98 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 3484 wrote to memory of 876 3484 axhost.exe 101 PID 1708 wrote to memory of 2748 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 102 PID 1708 wrote to memory of 2748 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 102 PID 1708 wrote to memory of 2748 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 102 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 2748 wrote to memory of 2104 2748 bxhost.exe 103 PID 1708 wrote to memory of 4456 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 104 PID 1708 wrote to memory of 4456 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 104 PID 1708 wrote to memory of 4456 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 104 PID 1708 wrote to memory of 2536 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 108 PID 1708 wrote to memory of 2536 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 108 PID 1708 wrote to memory of 2536 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 108 PID 3992 wrote to memory of 3476 3992 X 56 PID 4456 wrote to memory of 336 4456 cxhost.exe 110 PID 4456 wrote to memory of 336 4456 cxhost.exe 110 PID 4456 wrote to memory of 336 4456 cxhost.exe 110 PID 4456 wrote to memory of 4972 4456 cxhost.exe 113 PID 4456 wrote to memory of 4972 4456 cxhost.exe 113 PID 4456 wrote to memory of 4972 4456 cxhost.exe 113 PID 1708 wrote to memory of 3708 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 125 PID 1708 wrote to memory of 3708 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 125 PID 1708 wrote to memory of 3708 1708 d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe 125 PID 4456 wrote to memory of 2964 4456 cxhost.exe 140 PID 4456 wrote to memory of 2964 4456 cxhost.exe 140 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cxhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" cxhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exed563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\ce4Rf7.exeC:\Users\Admin\ce4Rf7.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\qeepio.exe"C:\Users\Admin\qeepio.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:8
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del ce4Rf7.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
-
-
C:\Users\Admin\axhost.exeC:\Users\Admin\axhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\axhost.exeaxhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:876
-
-
-
C:\Users\Admin\bxhost.exeC:\Users\Admin\bxhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\bxhost.exebxhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2104
-
-
-
C:\Users\Admin\cxhost.exeC:\Users\Admin\cxhost.exe4⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4456 -
C:\Users\Admin\cxhost.exeC:\Users\Admin\cxhost.exe startC:\Users\Admin\AppData\Roaming\7286C\61FF5.exe%C:\Users\Admin\AppData\Roaming\7286C5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:336
-
-
C:\Users\Admin\cxhost.exeC:\Users\Admin\cxhost.exe startC:\Program Files (x86)\6CE5E\lvvm.exe%C:\Program Files (x86)\6CE5E5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4972
-
-
C:\Program Files (x86)\LP\F507\71B0.tmp"C:\Program Files (x86)\LP\F507\71B0.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964
-
-
-
C:\Users\Admin\dxhost.exeC:\Users\Admin\dxhost.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Users\Admin\AppData\Local\5f0d574a\X193.105.154.210:805⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3992
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵PID:1852
-
-
-
C:\Users\Admin\exhost.exeC:\Users\Admin\exhost.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3708
-
-
C:\Users\Admin\fxhost.exeC:\Users\Admin\fxhost.exe4⤵PID:5072
-
C:\Users\Admin\fxhost.exefxhost.exe5⤵PID:3980
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del fxhost.exe6⤵PID:5012
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
PID:4584
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del d563e2f9a8d5d5c74c62eb533e90dd70_JaffaCakes118.exe4⤵PID:4220
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
PID:2476
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:448
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4852
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4352
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3544
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4808
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3924
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5008
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:1080
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3504
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2040
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4908
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4424
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2188
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4056
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4100
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4116
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:404
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5052
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1664
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1468
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3612
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1492
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3092
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2516
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3216
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4028
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3144
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3836
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4448
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2320
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:552
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4752
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3004
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5044
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4220
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4980
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4280
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3856
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4164
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:452
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3896
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4208
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4316
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2024
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3632
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3056
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5068
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1072
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3152
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1668
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3700
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3980
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2796
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3728
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4252
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2024
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3464
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1828
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3596
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2360
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3556
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:848
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3472
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2016
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5cfa7a6d662be5be703e426c1e849965f
SHA1aada98710adee405ef485dd2baf5bcceea1ca0ee
SHA25668144a7cd9379fcbf8872e7590903ea7b7054565792983e6728aeb18144f2cf3
SHA512233aadbfc65440c6fa2997a04c385200df16c97ff2d09c8b534f115b67834053e694d9b38e31fdb31ed7a4b84c1aac2795d7da107334467f2d310ab3e7571f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize471B
MD5b5eb055def3f532724935e0674304c5a
SHA18142a58ac1154ebc9de65053f850c0dbee5efaf8
SHA25663dec8553d3fb0b2568a7c3be1336caf3f0bdd157344b2d1c6926e3f47500702
SHA512fb92702e05e19c7857431e1edfcddf413aa8379aa8c6abbf3d9122a9cc3dea734b209150fee8aa723875c90d7b06ed6812564f3600a6fa5f567d8f2f6f55a3b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize420B
MD5db05e3c019aed6a0d3c34ec0927d9d2c
SHA1f09b4c38b21772e03e3cc84764f48b03dea84931
SHA2560f3362e2e981f3e493a9da90df8de334c139d0218aa0ee8a06bc0d90d528a8cc
SHA512e991d2c700de58a7ab9757fb8019cd3898943b22381d55703bdecfaaf3b56a4526f5cbd8f47f9d22b6e8b8bb17c06450fb9c6918763b62988819ca76041ee9cb
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
Filesize2KB
MD5212b6d9cbd5d08df969f525514512c2e
SHA1720dfe889b02b47f882e4e366b81d3fee45862d9
SHA256bf4021dfd2e9820b445e1425c7932c59f7b2173611dcf8cffbe39a63e90988ba
SHA5125a3a09548d0a7bfdc00519339f5f5781359129e572fc146ad4bfe0bb4e1d2a10234b7a31f86947fc8399a75b9125bf9bedaaf47bd4e896869c66e013de781c51
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QKJHZK6M\microsoft.windows[1].xml
Filesize96B
MD5c80e07f2e2bce84e8f3380b42ba6bd94
SHA133e20b05fc67a22ac3f3c214a32057254f97f2e7
SHA25614808d37f1d44780098ddc2af07f7862b3c0c5ab1bfed6b267621e0a332a8bbd
SHA512f5adf8b7bbc1b450249034376f7df69eaf2a7be8e516d511bb82828c19efddbee9247d20e4b4c629b7fe58c9391c31fbf48bdb1b857ca13e5f52b80cb7883f24
-
Filesize
996B
MD5d5a7ae5610c02eaf0c6d4023417724c9
SHA1c2adfa1830da9574552d4c19162c6db47f25d265
SHA2561f65d589a3ab6de0f5d9ead717170ee06bcdb5b8ec495f257cb427d5fadc6f3f
SHA512d7cd62de697f1fbe4eebccad943b7a00de78cae73c452d1dd66c661787a4248c7364bc07b53ad9b489f5529b7c8e573f21d6c09ca1be9f9534690eebea03805a
-
Filesize
1KB
MD51b351fca4494e3c10414dd65405eb8f9
SHA14162dfe0c9e7d25be02c50f0ad608f776adb4a6e
SHA25620e4ce34491bbb0368293feec084999e0ddcb3f63175216c6833af20b033f086
SHA51258ef2a572116d8656c9df452dab93791e9d49b0170601d7be2ac0136a59ce39c4435be44083e01b99fa161d8b0cc95a83ad450473d12bf6cd8c413e092e6801f
-
Filesize
600B
MD5b334b2bc80b510b2cd990ca75ff99661
SHA1f300dc6905c818fe0446af527b31887be1ba85f1
SHA256c1921705dab15b464858d3d487c2ad95a6bb6f7461be825ea51bb97e1f97854c
SHA512bf1aae95522ff7b9a6596d74db225d1efa6cab457766784996f7765e80ecf22e9723e8af032692e0af055b58c00cf2d4bde7761db9417d85090a85e7f4754de6
-
Filesize
153KB
MD552f42d7b3168372ea722c27cd526678a
SHA13185dc7b1776130e887da03111470b85a55307f9
SHA25653cdddd14430f557a92994899e348a3018b54f37d3ef95afbd507a5e266c31c9
SHA512af3dcb374d2027533ebd5668ec6c113b6aa34b61b4dcaf37b2d66675febd70f04f390ffe6f74ee74543ebf82e7c8af6df204daa50e579b2dd0d55cd9c53d426c
-
Filesize
146KB
MD5e6258d826a5e11ab09a7eb308932816d
SHA1de1a7a40607c2a2ef101a5837fb3f21d842be6b8
SHA256a8e6a92415e8de7ca067a89345e46cb73191be754722cd11b07373d5288e3bda
SHA512ab757c6a8be1a6b6c60e0e49d8858e51deaf8f901b677dfd35c6028b26bbb8bb0532a6f3e195038fcfa66420a417157b6f6bf8eb387dab675e31ff9ee3e7df47
-
Filesize
224KB
MD57d04f00a055b881ef4e1e61b78fefe42
SHA181599dc048176d45e5338ecab7f9b6591fb57549
SHA256fa2d0f1155bb0dbfa891cfe53f76b283549eb19b5aa65b44e3361b976f1ecfd2
SHA5122d5326284aebb34e6ee6e9f8773f03bc2e54359157f9ba3d7cb1d30be63cc96eebd114f063312fd030b34f4b03c6c02b9e0c324b1430f45a4d2698eadd254f91
-
Filesize
261KB
MD53cff661f3c8e46f339653a989974c5a9
SHA1a9141a0ecdc450538750b28bdd487d63670ad05c
SHA256b0776c3631b3b9f53ee9783ace63fe8c93db8d83f2362c43fd1ddce7cb4ab2b5
SHA5127e08d2675e450ac6b1a5b155062c6b9328f05395bb21acb09f2a2c479f16711b5526b0fa0ae72539ecb1285f39ae67759e5df5844707b0e03e6d203c1f4478ca
-
Filesize
333KB
MD524dfc0e20a45967e3beb04304d892ced
SHA177b8e906dc3e496b5e24682502cae210929ec3ef
SHA2563ddfe2c9854b36bb1ae469e6d6040b972c0b9e94870cf63bedd41602e22e4bbb
SHA512e58ebda08f9aee766bed1233fbdf884ef0de39b87ded559b004eeac2274358c42915329a036b54db02d1fe6ddd33fb1ded07285534b3e960266bd115ea400c11
-
Filesize
36KB
MD5805aa66b17cb3b6df005d564e818dbbc
SHA12b2239797e6f0b80e73323d64a341067506fd913
SHA2568598f1e53c608aa94919cd736eba115a597a5af6bb5869382a2f1750f0fb8a2e
SHA51287f8dc492a2a673639f028d27b2ba227e2e2dd13d65030bd0365b80fa88ff18a763fd624a434c80bee29f93675b9029492ff51d6343bd34dc2a5b968df3666fd
-
Filesize
103KB
MD5238baebf250614a48106ec4e34eb81c0
SHA17e0ce34860d8360dc71289e6e8b5876cbbd8569d
SHA25679e84dfa5cbd7d4601498d63a50d42f8590b1ed6bbaee1f5361e7676c9beb65c
SHA512dc306e139c24f5e4bfe324c0cc485cfdd9a4f5aa130c4d972d065350178206a9c0808fe6c540b2eb37422f5df0eff68eb46d7de047abfdf7a313923cfc75a743
-
Filesize
224KB
MD528108c4db4bd4d40ed340f1da4977fbf
SHA18e33743d9cbae43fd1aef9193e62cba883359de2
SHA256d723ec7771a37ada4e32e9e11475ace10fd2f271272ccdbbc35f704ee69ddcaa
SHA5121fa2a823a286840476dede2c85cb5e56dd70047a33a69f4745eaf7a84a85765e7fd69dad41cd16452d73f5b3d3a82c68d28bdea7289c4dc83f85bad0253c9a68