Overview

overview

10

Static

static

3

dee4876c70...18.exe

windows7-x64

10

dee4876c70...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    67s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-09-2024 20:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe

  • Size

    283KB

  • MD5

    dee4876c70f55a1259b064f9316c5b0e

  • SHA1

    3771114c6f0994148011a1e51b372eff6bf2eae4

  • SHA256

    5c95098911c9c89189723420d0f08892162c2c5f55d24384e59f2ddd2056a960

  • SHA512

    7682ae13579a0c50e2e4d6dc2d2cbd47d7e76798b54f350ab452b9b85478de641a1ac23aa389c54c5cb1ad38da81a83e33de97054e9f86cc92880db7d2cfac23

  • SSDEEP

    6144:NDuBe0IxJXxtlr+k2hGuT7iUxeKmL2v8g6Y8ha:RuBeNtlr+khuT7ir296YCa

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:452
    • C:\Users\Admin\AppData\Local\Temp\dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\7E97D\DCE4A.exe%C:\Users\Admin\AppData\Roaming\7E97D
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1140
    • C:\Users\Admin\AppData\Local\Temp\dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\dee4876c70f55a1259b064f9316c5b0e_JaffaCakes118.exe startC:\Program Files (x86)\7D256\lvvm.exe%C:\Program Files (x86)\7D256
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5100
    • C:\Program Files (x86)\LP\4A57\3C68.tmp
      "C:\Program Files (x86)\LP\4A57\3C68.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3984
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:212
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3460
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2156
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1644
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4136
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4532
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3744
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4256
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3448
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2368
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1644
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4256
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2672
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4312
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3972
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1244
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2280
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4464
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1092
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:932
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3752
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1276
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2760
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2112
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5024
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:4628
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:4036
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2880
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:784
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:4584
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3324
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:4668
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:2232
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:1920
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4944
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:4748
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4764
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:3584
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4828
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4280
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:2228
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4908
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:392
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:848
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:912
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3956
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:1632
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4904
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:1872
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4488
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4912
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:2924
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4992
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4032
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3252
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:2288
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:5028
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:2260

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    2
                                                                    T1547

                                                                    Active Setup

                                                                    1
                                                                    T1547.014

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Create or Modify System Process

                                                                    1
                                                                    T1543

                                                                    Windows Service

                                                                    1
                                                                    T1543.003

                                                                    Privilege Escalation

                                                                    Boot or Logon Autostart Execution

                                                                    2
                                                                    T1547

                                                                    Active Setup

                                                                    1
                                                                    T1547.014

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Create or Modify System Process

                                                                    1
                                                                    T1543

                                                                    Windows Service

                                                                    1
                                                                    T1543.003

                                                                    Defense Evasion

                                                                    Modify Registry

                                                                    5
                                                                    T1112

                                                                    Credential Access

                                                                    Credentials from Password Stores

                                                                    1
                                                                    T1555

                                                                    Credentials from Web Browsers

                                                                    1
                                                                    T1555.003

                                                                    Unsecured Credentials

                                                                    3
                                                                    T1552

                                                                    Credentials In Files

                                                                    3
                                                                    T1552.001

                                                                    Discovery

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    4
                                                                    T1012

                                                                    System Information Discovery

                                                                    2
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    Lateral Movement

                                                                    Collection

                                                                    Data from Local System

                                                                    2
                                                                    T1005

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Program Files (x86)\LP\4A57\3C68.tmp
                                                                      Filesize

                                                                      99KB

                                                                      MD5

                                                                      09fc60480d260601d7287a6fa0b2585e

                                                                      SHA1

                                                                      9bfbd669b666fda097fcd630d6a920f7f9b7d32c

                                                                      SHA256

                                                                      ac81a274ba5a25f9d61e0fb236e266bf4841b7081e06f39bf4ce4820b4f16bb2

                                                                      SHA512

                                                                      5b1ea94d02ac992b5a52ee98cb0e22829f9f96b32de254e45c2afabfc2a8740872fd429890a1b2ec849ab63cc71a6f002f540aa8c8b33a9b940eefffc5f02775

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                      Filesize

                                                                      471B

                                                                      MD5

                                                                      ddab9ba6d995c9cccd95964b4ad4ce40

                                                                      SHA1

                                                                      5345a6d122113475b8a2b36b3273efe1ea48f4e8

                                                                      SHA256

                                                                      f492031400502c7376269631d12a43ee11b3908b03a1bb0da7882bf23b0a7e9b

                                                                      SHA512

                                                                      ed56b541c9bab8cfbbef667351774a27133d47f3269c193f77bdc0b3108c7d4c090657a9e9c1bfe446d58badb6c56b99565784f4db3e04b85cdd7993a8a0dde4

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                      Filesize

                                                                      420B

                                                                      MD5

                                                                      de5ad6dcf317bc7c76a6f6bb3b43b92e

                                                                      SHA1

                                                                      2b2d9cb4295c545c2dcb52f5e92088eebca79dd2

                                                                      SHA256

                                                                      cc19bc7617ce0f6278506f119972db232d2abba42b5554d86765205cda342a98

                                                                      SHA512

                                                                      f1255ac3e398199a95708529d646dc7e9535e73b8c5fc995d7b86f8c0336ee7b2fdd9b7fac98f497f6fc4c85d029df9fde8452d6e81bdf696095cc4e8959118f

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      2c48c927cb8d19a126185fb494610909

                                                                      SHA1

                                                                      2c6dc3bca1dff5a7311f437b6cf3a0a5255e8d4d

                                                                      SHA256

                                                                      854ca79f75ac487c6acc4a09ae9162d0aad163972bdcd2831e07f1f17aacfd60

                                                                      SHA512

                                                                      6f66ebc0d255133b08fa0d2e498277b1775c8b5dc00dbce7573edd7764c9f86b6b1fab0855808ac22034572da590939d9c3575645bae1bba48a9eeee550d4668

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133707349338364805.txt
                                                                      Filesize

                                                                      75KB

                                                                      MD5

                                                                      62624201a0c6f523fc681f2d24bc0243

                                                                      SHA1

                                                                      8ad3fe2217e66fea516ca917cf7a9cd62a57a432

                                                                      SHA256

                                                                      19b5b7425f83e4b5a6bba43873c299b106a8c1e3ef6329c62bb62d4f3784c880

                                                                      SHA512

                                                                      7404a5a042af4f8b96c4941406861941b123ff42fd33e5150c87244d59fa4af993a3bfd053155237a6fee03531cf4706c4edf8f60e0770735a57c5f7d4f4f659

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml
                                                                      Filesize

                                                                      97B

                                                                      MD5

                                                                      d28bf9e615b97abc4f63418e57cc40bc

                                                                      SHA1

                                                                      65885f634c0b15cabd1caf45861e7767f3110e44

                                                                      SHA256

                                                                      92e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7

                                                                      SHA512

                                                                      23e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Roaming\7E97D\D256.E97
                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      5b27a024944c7e643fd037836da50c7f

                                                                      SHA1

                                                                      da21a7bf327b8f04358791ddee591df5e03e9156

                                                                      SHA256

                                                                      4d88b1d138a64aaf2618eadc0d1f27c564439b0023e90b0eb02eac975e0e5375

                                                                      SHA512

                                                                      0f4fd150461f8564a82a3128fccd2aa7d367ea49ba8c49711fd90564d4997514fe949fc0206e0e290f6f0a55d59adbb77927da4aa63ffa7e96db910a7ffe7279

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Roaming\7E97D\D256.E97
                                                                      Filesize

                                                                      600B

                                                                      MD5

                                                                      6c7f17e0429df53af59a154a70c4e329

                                                                      SHA1

                                                                      1fee8c5dcef4af84a4b6e967391c505b7792bfc4

                                                                      SHA256

                                                                      e248554d2b79b3500eeddc65a51542f7dca6eb445b093c483afdd97169fe704b

                                                                      SHA512

                                                                      ee34d454da2a4c1a91b857df02f469627fc1878c0fb6c427b32863b125019e7934a5290ae4171f2e606fea0169ce7e5c963e27e1204fd549e2902cd8c37015e9

                                                                      Download Submit

                                                                    • C:\Users\Admin\AppData\Roaming\7E97D\D256.E97
                                                                      Filesize

                                                                      996B

                                                                      MD5

                                                                      d31f617c5016160923eb9ee8f765c481

                                                                      SHA1

                                                                      7bb2af02a10d681a732d8e07dfa1dc07f14371a8

                                                                      SHA256

                                                                      3cc8fcecba67e5b280603ab521f381667b6db413994bf5658d3f9ceea825911f

                                                                      SHA512

                                                                      63543e9bc42fdf7ef9ba7304a85fa7e13c5d6817f62766d800cce532788bc944c014a1004b96b0718c604a8ef905b4e930b0d78fa9b5b5603c565df4fc7e40e0

                                                                      Download Submit

                                                                    • memory/452-12-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                      Filesize

                                                                      416KB

                                                                      Download

                                                                    • memory/452-1227-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/452-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/452-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/452-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                      Filesize

                                                                      416KB

                                                                      Download

                                                                    • memory/452-352-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/452-118-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/784-1381-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/932-938-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/1092-791-0x000001E890800000-0x000001E890900000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/1092-817-0x000001E891CC0000-0x000001E891CE0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1092-792-0x000001E890800000-0x000001E890900000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/1092-805-0x000001E8916A0000-0x000001E8916C0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1092-796-0x000001E8916E0000-0x000001E891700000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1140-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/1140-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/1140-16-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download

                                                                    • memory/1244-654-0x00000195625D0000-0x00000195625F0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1244-651-0x0000019561500000-0x0000019561600000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/1244-649-0x0000019561500000-0x0000019561600000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/1244-662-0x0000019562590000-0x00000195625B0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1244-686-0x00000195629A0000-0x00000195629C0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1276-971-0x00000132EE490000-0x00000132EE4B0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1276-945-0x00000132EE0C0000-0x00000132EE0E0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1276-959-0x00000132EE080000-0x00000132EE0A0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/1644-497-0x0000000004120000-0x0000000004121000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2280-789-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2672-504-0x00000241BDD00000-0x00000241BDD20000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2672-519-0x00000241BE0D0000-0x00000241BE0F0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2672-508-0x00000241BDCC0000-0x00000241BDCE0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2672-499-0x00000241BCC00000-0x00000241BCD00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/2760-1086-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/2880-1231-0x0000012584900000-0x0000012584A00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/2880-1236-0x00000125858E0000-0x0000012585900000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2880-1262-0x0000012585CB0000-0x0000012585CD0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/2880-1252-0x00000125858A0000-0x00000125858C0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3324-1385-0x00000271B3300000-0x00000271B3400000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/3448-354-0x0000000004140000-0x0000000004141000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/3752-393-0x0000016096EE0000-0x0000016096F00000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3752-357-0x0000016095A00000-0x0000016095B00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/3752-358-0x0000016095A00000-0x0000016095B00000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/3752-361-0x0000016096910000-0x0000016096930000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3752-370-0x00000160968D0000-0x00000160968F0000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/3984-196-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                      Filesize

                                                                      112KB

                                                                      Download

                                                                    • memory/4256-200-0x000001DA86DC0000-0x000001DA86EC0000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/4256-236-0x000001E2892F0000-0x000001E289310000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/4256-230-0x000001E288BE0000-0x000001E288C00000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/4256-205-0x000001E288F20000-0x000001E288F40000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/4256-201-0x000001DA86DC0000-0x000001DA86EC0000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/4312-647-0x0000000004650000-0x0000000004651000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4532-198-0x0000000003170000-0x0000000003171000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/4628-1229-0x0000000004760000-0x0000000004761000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download

                                                                    • memory/5024-1105-0x00000299D5FE0000-0x00000299D6000000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/5024-1088-0x00000299D4F00000-0x00000299D5000000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/5024-1089-0x00000299D4F00000-0x00000299D5000000-memory.dmp

                                                                      Filesize

                                                                      1024KB

                                                                      Download

                                                                    • memory/5024-1118-0x00000299D65F0000-0x00000299D6610000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/5024-1094-0x00000299D6220000-0x00000299D6240000-memory.dmp

                                                                      Filesize

                                                                      128KB

                                                                      Download

                                                                    • memory/5100-83-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                      Filesize

                                                                      428KB

                                                                      Download