Overview

overview

8

Static

static

3

saturnspoo...ed.exe

windows10-2004-x64

8

Resubmissions

09/09/2024, 11:55

240909-n3zbrsyeqd 5

09/09/2024, 11:52

240909-n11f2syeja 8

Analysis

  • max time kernel
    37s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 11:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    saturnspoofer_cracked.exe

  • Size

    943KB

  • MD5

    72a2994003e8c41a4d7bc303919702b9

  • SHA1

    5a890736c4dc0c24ae2f0b69cc0c326b8c42f293

  • SHA256

    9e05eebd28de44830ee2e3c2b4ebbbeef016a238dd2639ab668ed4e300dac847

  • SHA512

    18d4a4cdfa6238c6633b71b79e8a930e60d8e9d48d150db3395365c66c6843d2f718b43b555645108ec82e3a23b6367f5e82846e2b7114cb40fd1da1886d2345

  • SSDEEP

    12288:mNJrYX+cZOzVOnFm5YX+mZ028x9GJd4hXZ5kppTOFV:UYLkzYn0rmZ0228Jd0Z5aOF

Score
8/10
discoveryevasionexecutionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 18 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\saturnspoofer_cracked.exe
    "C:\Users\Admin\AppData\Local\Temp\saturnspoofer_cracked.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\saturnspoofer_cracked.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\saturnspoofer_cracked.exe" MD5
        3⤵
          PID:3388
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:4876
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:2008
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c color 5
            2⤵
              PID:3440
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              2⤵
                PID:3084
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                2⤵
                  PID:4496
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c start explorer.exe
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4356
                  • C:\Windows\explorer.exe
                    explorer.exe
                    3⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Enumerates connected drives
                    • Checks SCSI registry key(s)
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:244
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c cls
                  2⤵
                    PID:2764
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c start explorer.exe
                    2⤵
                      PID:1108
                      • C:\Windows\explorer.exe
                        explorer.exe
                        3⤵
                          PID:4304
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c cls
                        2⤵
                          PID:3040
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Windows\System32\deepcln.bat
                          2⤵
                            PID:4460
                            • C:\Windows\system32\cacls.exe
                              "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                              3⤵
                                PID:776
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im epicgameslauncher.exe
                                3⤵
                                • Kills process with taskkill
                                PID:4896
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
                                3⤵
                                • Kills process with taskkill
                                PID:4548
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
                                3⤵
                                • Kills process with taskkill
                                PID:4520
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im FortniteLauncher.exe
                                3⤵
                                • Kills process with taskkill
                                PID:4996
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im OneDrive.exe
                                3⤵
                                • Kills process with taskkill
                                PID:3788
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im FortniteClient-Win64-Shipping.exe
                                3⤵
                                • Kills process with taskkill
                                PID:5112
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im EpicGamesLauncher.exe
                                3⤵
                                • Kills process with taskkill
                                PID:2700
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im UnrealCEFSubProcess.exe
                                3⤵
                                • Kills process with taskkill
                                PID:4028
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im CEFProcess.exe
                                3⤵
                                • Kills process with taskkill
                                PID:5084
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im EasyAntiCheat.exe
                                3⤵
                                • Kills process with taskkill
                                PID:2968
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im BEService.exe
                                3⤵
                                • Kills process with taskkill
                                PID:3928
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im BEServices.exe
                                3⤵
                                • Kills process with taskkill
                                PID:4848
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im BattleEye.exe
                                3⤵
                                • Kills process with taskkill
                                PID:1480
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im PerfWatson2.exe
                                3⤵
                                • Kills process with taskkill
                                PID:1252
                              • C:\Windows\System32\taskkill.exe
                                taskkill /f /im vgtray.exe
                                3⤵
                                • Kills process with taskkill
                                PID:3156
                              • C:\Windows\System32\sc.exe
                                Sc stop EasyAntiCheat
                                3⤵
                                • Launches sc.exe
                                PID:1768
                              • C:\Windows\System32\sc.exe
                                Sc stop FortniteClient-Win64-Shipping_EAC
                                3⤵
                                • Launches sc.exe
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:752
                              • C:\Windows\System32\sc.exe
                                Sc stop BattleEye
                                3⤵
                                • Launches sc.exe
                                PID:2252
                              • C:\Windows\System32\sc.exe
                                Sc stop FortniteClient-Win64-Shipping_BE
                                3⤵
                                • Launches sc.exe
                                • System Network Configuration Discovery: Internet Connection Discovery
                                PID:4980
                              • C:\Windows\System32\reg.exe
                                reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /f
                                3⤵
                                  PID:5000
                                • C:\Windows\System32\reg.exe
                                  reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /f
                                  3⤵
                                    PID:3036
                                  • C:\Windows\System32\reg.exe
                                    reg delete "HKU\S-1-5-21-860440266-1445122309-108474356-1001\Software\Epic Games\Unreal Engine\Identifiers" /va /f
                                    3⤵
                                      PID:2344
                                    • C:\Windows\System32\reg.exe
                                      reg delete "HKU\S-1-5-21-860440266-1445122309-108474356-1001\Software\Epic Games\Unreal Engine\Hardware Survey" /va /f
                                      3⤵
                                        PID:4804
                                      • C:\Windows\System32\reg.exe
                                        reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
                                        3⤵
                                          PID:876
                                        • C:\Windows\System32\reg.exe
                                          reg delete "HKU\S-1-5-21-860440266-1445122309-108474356-1001\Software\Epic Games" /f
                                          3⤵
                                            PID:672
                                          • C:\Windows\System32\reg.exe
                                            REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d DESKTOP-9444 /f
                                            3⤵
                                            • Modifies registry key
                                            PID:2764
                                          • C:\Windows\System32\reg.exe
                                            REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d DESKTOP-3723 /f
                                            3⤵
                                            • Modifies registry key
                                            PID:3740
                                          • C:\Windows\System32\reg.exe
                                            reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
                                            3⤵
                                              PID:4576
                                            • C:\Windows\System32\reg.exe
                                              reg delete "HKEY_CURRENT_USER\Software\Microsoft\Direct3D" /v WHQLClass /f
                                              3⤵
                                                PID:1140
                                              • C:\Windows\System32\reg.exe
                                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2532382528-581214834-2534474248-1001\Device\HarddiskVolume3\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping_EAC.exe: B1 8A B0 E9 8D 13 D5 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00" /f"
                                                3⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                PID:3692
                                              • C:\Windows\System32\reg.exe
                                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2532382528-581214834-2534474248-1001\Device\HarddiskVolume3\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\EasyAntiCheat\EasyAntiCheat_Setup.exe: 73 D5 4B 11 8D 13 D5 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00" /f"
                                                3⤵
                                                  PID:3020
                                                • C:\Windows\System32\reg.exe
                                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2532382528-581214834-2534474248-1001\Device\HarddiskVolume3\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe: E7 CB 84 E9 8D 13 D5 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00" /f"
                                                  3⤵
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  PID:5108
                                                • C:\Windows\System32\reg.exe
                                                  reg delete "HKU\.Dreg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
                                                  3⤵
                                                    PID:2140
                                                  • C:\Windows\System32\reg.exe
                                                    reg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /f
                                                    3⤵
                                                      PID:4224
                                                    • C:\Windows\System32\reg.exe
                                                      reg delete "HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games" /f
                                                      3⤵
                                                        PID:3700
                                                      • C:\Windows\System32\reg.exe
                                                        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /f
                                                        3⤵
                                                          PID:4976
                                                        • C:\Windows\System32\taskkill.exe
                                                          taskkill /f /im EpicGamesLauncher.exe
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:2072
                                                        • C:\Windows\System32\taskkill.exe
                                                          taskkill /f /im FortniteClient-Win64-Shipping.exe
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:3504
                                                        • C:\Windows\System32\taskkill.exe
                                                          taskkill /f /im OneDrive.exe
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:1436
                                                        • C:\Windows\System32\reg.exe
                                                          reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Epic Games" /f
                                                          3⤵
                                                            PID:3040
                                                          • C:\Windows\System32\reg.exe
                                                            reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\EpicGames" /f
                                                            3⤵
                                                              PID:3668
                                                            • C:\Windows\System32\reg.exe
                                                              reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /f
                                                              3⤵
                                                                PID:3224
                                                              • C:\Windows\System32\reg.exe
                                                                reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames" /f
                                                                3⤵
                                                                  PID:1392
                                                                • C:\Windows\System32\reg.exe
                                                                  reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Description: "Provides integrated security and services for online multiplayer games."" /f
                                                                  3⤵
                                                                    PID:376
                                                                  • C:\Windows\System32\reg.exe
                                                                    reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security\Security: 01 00 14 80 A0 00 00 00 AC 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 70 00 05 00 00 00 00 00 14 00 30 00 02 00 01 01 00 00 00 00 00 01 00 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 06 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00" /f
                                                                    3⤵
                                                                      PID:4896
                                                                    • C:\Windows\System32\reg.exe
                                                                      reg delete "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat\GamesInstalled: "217;"" /f
                                                                      3⤵
                                                                        PID:3508
                                                                      • C:\Windows\System32\reg.exe
                                                                        reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Type: 0x00000010" /f
                                                                        3⤵
                                                                          PID:4984
                                                                        • C:\Windows\System32\reg.exe
                                                                          reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Start: 0x00000003" /f
                                                                          3⤵
                                                                            PID:3400
                                                                          • C:\Windows\System32\reg.exe
                                                                            reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ErrorControl: 0x00000001" /f
                                                                            3⤵
                                                                              PID:2676
                                                                            • C:\Windows\System32\reg.exe
                                                                              reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\ImagePath: ""C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe""" /f
                                                                              3⤵
                                                                                PID:3872
                                                                              • C:\Windows\System32\reg.exe
                                                                                reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\DisplayName: "EasyAntiCheat"" /f
                                                                                3⤵
                                                                                  PID:4080
                                                                                • C:\Windows\System32\reg.exe
                                                                                  reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\WOW64: 0x0000014C" /f
                                                                                  3⤵
                                                                                    PID:116
                                                                                  • C:\Windows\System32\reg.exe
                                                                                    reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /f"
                                                                                    3⤵
                                                                                      PID:2844
                                                                                    • C:\Windows\System32\reg.exe
                                                                                      reg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security" /f"
                                                                                      3⤵
                                                                                        PID:2176
                                                                                      • C:\Windows\System32\reg.exe
                                                                                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /f"
                                                                                        3⤵
                                                                                          PID:2216
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4520
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                      • Enumerates connected drives
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:4576
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3508
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1060
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                      • Enumerates connected drives
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:3552
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3828
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                      • Enumerates connected drives
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      PID:4780
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3884
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1764
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                      • Enumerates connected drives
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Modifies registry class
                                                                                      PID:2344
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3028
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:3056
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                      • Enumerates connected drives
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Modifies registry class
                                                                                      PID:4852
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:208
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                      1⤵
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4948
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4304
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:1060
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:696
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:4356
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:3872
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:2892
                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                    2⤵
                                                                                                      PID:2184
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:4660
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4120

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                        Filesize

                                                                                                        471B

                                                                                                        MD5

                                                                                                        fb6d48dad9b7772689e7f825b3774772

                                                                                                        SHA1

                                                                                                        be3ec403f876cc98263290a8fd1c1b5e55649098

                                                                                                        SHA256

                                                                                                        d21e170115828f1cab36a101f06c2212596bfbc6bcdae8ec2cf34e48fbbe6f19

                                                                                                        SHA512

                                                                                                        ac808ab2652e911fea4a3177102bca8e24245be005e49960c8dbce32a061c264551e33bbf7396ad120342d7e7fc9d8d9c9bcbbd182a5537d803b6cc18de63afe

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                        Filesize

                                                                                                        420B

                                                                                                        MD5

                                                                                                        65f821b6ee5ccec8be37bbea77691d17

                                                                                                        SHA1

                                                                                                        1c08b9ec5ef5bb05a5874cc88f1a0d59d71efc79

                                                                                                        SHA256

                                                                                                        b72c3a01b057e279f8faab5ec27f366933721b985e6052d4bcdfa40fdc408d17

                                                                                                        SHA512

                                                                                                        71c6b7cc5abc7dc11aae2f4d10afa409560d0d1d964f62b9bfce6a25f76ca8de53cf33a34ac32fe7bd4ba3d331ba423ec2fe6a1c7f15dd237b733eb9251d478c

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\E80108~1\F4EB2D~1.IDX
                                                                                                        Filesize

                                                                                                        64KB

                                                                                                        MD5

                                                                                                        d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                        SHA1

                                                                                                        2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                        SHA256

                                                                                                        b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                        SHA512

                                                                                                        c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\E80108~1\F4EB2D~1.LOC
                                                                                                        Filesize

                                                                                                        4B

                                                                                                        MD5

                                                                                                        f49655f856acb8884cc0ace29216f511

                                                                                                        SHA1

                                                                                                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                        SHA256

                                                                                                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                        SHA512

                                                                                                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\D3DSCache\E80108~1\F4EB2D~1.VAL
                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        6bd369f7c74a28194c991ed1404da30f

                                                                                                        SHA1

                                                                                                        0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                        SHA256

                                                                                                        878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                        SHA512

                                                                                                        8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        687beb0b2f5ad1e3e6b09d66ed1714c7

                                                                                                        SHA1

                                                                                                        7a8b0a87722d2a0f0d21b04cee4b82cebd643653

                                                                                                        SHA256

                                                                                                        0534c4328e37706bdda624cc1c03037ce0a3f74cbc2fc1b22c1ff6753056dd5d

                                                                                                        SHA512

                                                                                                        98278891b60d0ef48accbc9386c71e007d5bd299f930ef66719757a9de11a25e0c9737ffdb689afee9fba1abfcaff9b17740611cc15ed0e97c17170876683e88

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133703564185928924.txt
                                                                                                        Filesize

                                                                                                        75KB

                                                                                                        MD5

                                                                                                        0a30d62839d0e43aed608c97dc71a0a0

                                                                                                        SHA1

                                                                                                        dba6e72baa91c9cbe1466dc39ae7bf1939192aec

                                                                                                        SHA256

                                                                                                        9081e08aac089269758592d2cc1cab36c3fe393f54213f1837a974db2cc505f4

                                                                                                        SHA512

                                                                                                        247c75db1f5de6804c3b6cb3bac21bb291c4bc30cb30ccd555e732cf6a87c2cd466c31f735e40e8e5ecd57c7327212765cab21567d0d9fe7c43649fb45a03d76

                                                                                                        Download Submit

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml
                                                                                                        Filesize

                                                                                                        97B

                                                                                                        MD5

                                                                                                        d28bf9e615b97abc4f63418e57cc40bc

                                                                                                        SHA1

                                                                                                        65885f634c0b15cabd1caf45861e7767f3110e44

                                                                                                        SHA256

                                                                                                        92e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7

                                                                                                        SHA512

                                                                                                        23e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0

                                                                                                        Download Submit

                                                                                                      • C:\Windows\System32\deepcln.bat
                                                                                                        Filesize

                                                                                                        266KB

                                                                                                        MD5

                                                                                                        b94b1233c9a56daff1eb902f16b3eb7e

                                                                                                        SHA1

                                                                                                        a475a4b44deb9aac26e9d8bc189fe0fafb940c78

                                                                                                        SHA256

                                                                                                        931c486257d11083dde8e011bc8b154c93eb3d3366c88b7a7128d8f2010c61d6

                                                                                                        SHA512

                                                                                                        0b48c133d8877759fd932248af6766eb1f79d1d7117241da368281d1c12388ed33aff4228bcda1dbe1526ddeeb20dd446544a1311a116db7579396d20e418a4b

                                                                                                        Download Submit

                                                                                                      • memory/696-599-0x000001B79A920000-0x000001B79AA20000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/696-598-0x000001B79A920000-0x000001B79AA20000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/696-616-0x000001B79BA30000-0x000001B79BA50000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/696-630-0x000001B79BE40000-0x000001B79BE60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/696-603-0x000001B79BA70000-0x000001B79BA90000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1060-45-0x0000022C29010000-0x0000022C29030000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1060-31-0x0000022C28C00000-0x0000022C28C20000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1060-14-0x0000022C28C40000-0x0000022C28C60000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1764-196-0x0000021CA3FA0000-0x0000021CA3FC0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1764-176-0x0000021CA3B90000-0x0000021CA3BB0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1764-164-0x0000021CA3BD0000-0x0000021CA3BF0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/1764-160-0x00000214A1B00000-0x00000214A1C00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/1764-159-0x00000214A1B00000-0x00000214A1C00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/2184-867-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-873-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-872-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-874-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-876-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-877-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-875-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-871-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-866-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2184-865-0x0000027107090000-0x0000027107091000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2344-301-0x0000000004080000-0x0000000004081000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/2892-746-0x00000000047C0000-0x00000000047C1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/3056-304-0x00000211D8600000-0x00000211D8700000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/3056-308-0x00000211D9500000-0x00000211D9520000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3056-305-0x00000211D8600000-0x00000211D8700000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/3056-320-0x00000211D94C0000-0x00000211D94E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/3056-340-0x00000211D9AE0000-0x00000211D9B00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4120-752-0x00000197903B0000-0x00000197903D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4120-776-0x0000019790780000-0x00000197907A0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4120-761-0x0000019790370000-0x0000019790390000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4120-747-0x000001978F250000-0x000001978F350000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/4304-596-0x00000000045E0000-0x00000000045E1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4576-7-0x0000000003640000-0x0000000003641000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4780-158-0x0000000004110000-0x0000000004111000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4852-453-0x0000000004320000-0x0000000004321000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        Download

                                                                                                      • memory/4948-455-0x000002E4D4300000-0x000002E4D4400000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/4948-456-0x000002E4D4300000-0x000002E4D4400000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                        Download

                                                                                                      • memory/4948-460-0x000002E4D5440000-0x000002E4D5460000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4948-492-0x000002E4D5800000-0x000002E4D5820000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download

                                                                                                      • memory/4948-468-0x000002E4D5400000-0x000002E4D5420000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        Download