Overview

overview

10

Static

static

3

e3066f31c7...18.exe

windows7-x64

10

e3066f31c7...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-09-2024 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e3066f31c71cac3c609092cdad3c0e9b_JaffaCakes118.exe

  • Size

    267KB

  • MD5

    e3066f31c71cac3c609092cdad3c0e9b

  • SHA1

    7d9299ea2fd2f800e5dab38b72ac5cb2c6f07f59

  • SHA256

    0d70d39d3e4f97d520c1be6477a6e79335494694e3828707727add52d461dd27

  • SHA512

    8d1566c2974a17043d3ca2c16019b102afc4a5e0e037fa68c23df8995f01ba7cba8b2412b5010ece9e009213beb46d0f62e2f9eccfd7d4df79aba942db1a0351

  • SSDEEP

    6144:PJZHRPK6dqc5PP/6ri5BliRWXiBpTcfyCIRnoCSTiti:XRPL0q36+5BliWiBpTEUoCSEi

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3066f31c71cac3c609092cdad3c0e9b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e3066f31c71cac3c609092cdad3c0e9b_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\e3066f31c71cac3c609092cdad3c0e9b_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\e3066f31c71cac3c609092cdad3c0e9b_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\8CF07\8CCA0.exe%C:\Users\Admin\AppData\Roaming\8CF07
      2⤵
        PID:2312
      • C:\Users\Admin\AppData\Local\Temp\e3066f31c71cac3c609092cdad3c0e9b_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\e3066f31c71cac3c609092cdad3c0e9b_JaffaCakes118.exe startC:\Program Files (x86)\07DFD\lvvm.exe%C:\Program Files (x86)\07DFD
        2⤵
          PID:4236
        • C:\Program Files (x86)\LP\A038\7E53.tmp
          "C:\Program Files (x86)\LP\A038\7E53.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3312
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2148
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2356
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2772
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4412
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1724
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4380
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4204
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1344
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3128
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4252
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4496
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4192
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2408
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4820
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:692
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5020
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1556
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2088
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3528
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5024
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3848
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1172
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4460
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4296
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2828
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4444
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:5076
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3992
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4116
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3660
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4128
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4432
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3232
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4872
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4124
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:976
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4984
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1304
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4500
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:848
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3792
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3160
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:5076
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4756
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3552
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4964
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:1432
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:2132
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4392
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4256
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4420
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4720
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:392
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3528
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1532
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:692
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:4304
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:1884
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2348
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:1876
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4444
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3392
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4204
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3448
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:2536
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4432
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:4548
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1352
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:4188

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Persistence

                                                                      Boot or Logon Autostart Execution

                                                                      2
                                                                      T1547

                                                                      Active Setup

                                                                      1
                                                                      T1547.014

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      1
                                                                      T1543

                                                                      Windows Service

                                                                      1
                                                                      T1543.003

                                                                      Privilege Escalation

                                                                      Boot or Logon Autostart Execution

                                                                      2
                                                                      T1547

                                                                      Active Setup

                                                                      1
                                                                      T1547.014

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Create or Modify System Process

                                                                      1
                                                                      T1543

                                                                      Windows Service

                                                                      1
                                                                      T1543.003

                                                                      Defense Evasion

                                                                      Modify Registry

                                                                      5
                                                                      T1112

                                                                      Credential Access

                                                                      Credentials from Password Stores

                                                                      1
                                                                      T1555

                                                                      Credentials from Web Browsers

                                                                      1
                                                                      T1555.003

                                                                      Unsecured Credentials

                                                                      3
                                                                      T1552

                                                                      Credentials In Files

                                                                      3
                                                                      T1552.001

                                                                      Discovery

                                                                      Peripheral Device Discovery

                                                                      2
                                                                      T1120

                                                                      Query Registry

                                                                      4
                                                                      T1012

                                                                      System Information Discovery

                                                                      2
                                                                      T1082

                                                                      System Location Discovery

                                                                      1
                                                                      T1614

                                                                      System Language Discovery

                                                                      1
                                                                      T1614.001

                                                                      Lateral Movement

                                                                      Collection

                                                                      Data from Local System

                                                                      2
                                                                      T1005

                                                                      Command and Control

                                                                      Exfiltration

                                                                      Impact

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\Program Files (x86)\LP\A038\7E53.tmp
                                                                        Filesize

                                                                        96KB

                                                                        MD5

                                                                        ba95d7af476e2f0d6039fef205744c28

                                                                        SHA1

                                                                        9071fef86525b26503db05d87e0ce91da9bacfef

                                                                        SHA256

                                                                        e376030d38f15fce9364f5368197d1940ab0707703c27fb891beb8a9da7ddb64

                                                                        SHA512

                                                                        e848e223ec50ebef4a4fb0f66d5adaf1259690693b414fd18e459e3dbaff933bc33dd0194de7d7b76c319482d95e7cb8770b4fe238e4bd5b97c2eba785a6fb96

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                        Filesize

                                                                        471B

                                                                        MD5

                                                                        5b9abf66452eeea1d7c44fb81e6c7047

                                                                        SHA1

                                                                        a3eda0a768aea6e3a021e988ac5cf9c15e11072d

                                                                        SHA256

                                                                        285dc0e6a72e0d4f76f67008be3bd353cbd27504af8e4d764b14210b8b2d0f75

                                                                        SHA512

                                                                        e79df652950bb3a859d8aae8a05af9f70e510633e48e65f89948af06b1b34daa51973909483e09c54d0f4484d8146922950e9ac1e33c06225959fd86068d4e26

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                        Filesize

                                                                        420B

                                                                        MD5

                                                                        13b91d4ff58ddc4a0eeaaa1c31176bc1

                                                                        SHA1

                                                                        40cdbe5d9799f8241569546b40f1372e6a994d0c

                                                                        SHA256

                                                                        6032830a24036a611ff9981d5c9ec2641201cf068596bd40bbefbcb47eb117a8

                                                                        SHA512

                                                                        04519d04992205cd4702d4078ccd6b77974962f0e21e8271ae64dd11eae65890cd01fb1670a4c4a42a559ac6a283cac996ef00198b3c08de98c1c60c07901837

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                        Filesize

                                                                        2KB

                                                                        MD5

                                                                        c0a61991f4d167134b4b261a2bc48342

                                                                        SHA1

                                                                        2771680e7434bb1932ec987bab238ee9849c64b9

                                                                        SHA256

                                                                        1d0cb0a05884fe854f8b6fa5f229b8100cb4e5cc0ef1a10e8adc398a19ee2e2f

                                                                        SHA512

                                                                        ecda5166af96c7727c4e6f0a4815d0c1987d90500f4feec7c51eb4c3d2524d47e2e4309477b84097ed582e4706f07b104bf15c86fddf836b98c1bcaa95c0497c

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Y25IPP08\microsoft.windows[1].xml
                                                                        Filesize

                                                                        97B

                                                                        MD5

                                                                        d07a8eeeb6da833c3c127ff207daead9

                                                                        SHA1

                                                                        cc8a12f7c600ac6ad8211f50045ca376f88f3cb6

                                                                        SHA256

                                                                        113038e3d15cda4a50c0980cb7075456d00b0770a1c436b68cea36b435363392

                                                                        SHA512

                                                                        84bac1ea9a2bac093a6356933b08c841d1ef922937d05db05b388b6b107d77a7edcf6431db083a89e611c86c2ed9e8e83207e798edb08e3e056045780a432800

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\8CF07\7DFD.CF0
                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        c9385771fef7c77d6c113539ad39e234

                                                                        SHA1

                                                                        15c08f6c4c960da59e3920985177078fe31e0061

                                                                        SHA256

                                                                        c82e122a02cd93c519f7776594a8574ef8f4331794c2c159e193c1eb7fa823c3

                                                                        SHA512

                                                                        43285609a74a4527437a0a182dfbd99d2132512e9f90257a8bf31fc6fb102dd8c93cab851e69d2b1690b772eeec1c41e15e03dea96f0fbfa8ba5aa2780048f24

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\8CF07\7DFD.CF0
                                                                        Filesize

                                                                        600B

                                                                        MD5

                                                                        f2356da48e01827a0f6457ebb7b98ec0

                                                                        SHA1

                                                                        7c4e44b7abdc335ad05f957e2254b11c3f790eb9

                                                                        SHA256

                                                                        866940ce577bd57cb1824c74c721771f519ddc262595132b637b18cebd124326

                                                                        SHA512

                                                                        96367a70d64aeeb6d34bce0333951f8079c50640deb26950b4da1188ee851b21e9c2145c22daf64727373b4294628f5ecfbd353f77ba0081174f0af408aab58c

                                                                        Download Submit

                                                                      • C:\Users\Admin\AppData\Roaming\8CF07\7DFD.CF0
                                                                        Filesize

                                                                        996B

                                                                        MD5

                                                                        a5979ac6aa4844b52f685c85078ff7d9

                                                                        SHA1

                                                                        5a49a4ebd9f7d5081623c811353cd9938ffaff3a

                                                                        SHA256

                                                                        77f158d5bbe52f56e632bfa7883683172572b0a5eeb7e14f25662d739e834b8a

                                                                        SHA512

                                                                        f91619e1297128905a2e915d34261e8aad90f72f2ab33dc6531f6d4c28061b592535091d1c3ba3e2d49741729a87b084661f83c8d838f9f37cc9df6f7a00a60c

                                                                        Download Submit

                                                                      • memory/692-644-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/1172-793-0x00000200BE420000-0x00000200BE520000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/1172-794-0x00000200BE420000-0x00000200BE520000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/1172-797-0x00000200BF580000-0x00000200BF5A0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1172-792-0x00000200BE420000-0x00000200BE520000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/1172-819-0x00000200BF950000-0x00000200BF970000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1172-807-0x00000200BF540000-0x00000200BF560000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1344-193-0x000001D0C1BD0000-0x000001D0C1BF0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1344-224-0x000001D0C1FA0000-0x000001D0C1FC0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1344-203-0x000001D0C1B90000-0x000001D0C1BB0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1344-188-0x000001C8BFB00000-0x000001C8BFC00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/1556-647-0x000001F055A00000-0x000001F055B00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/1556-646-0x000001F055A00000-0x000001F055B00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/1556-663-0x000001F857B00000-0x000001F857B20000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1556-682-0x000001F857F00000-0x000001F857F20000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1556-651-0x000001F857B40000-0x000001F857B60000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/1696-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/1696-286-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/1696-14-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/1696-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                        Filesize

                                                                        416KB

                                                                        Download

                                                                      • memory/1696-910-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/1696-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/1696-71-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/2312-17-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/2312-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/2312-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/2828-948-0x000002243E040000-0x000002243E060000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2828-973-0x000002243E410000-0x000002243E430000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/2828-959-0x000002243E000000-0x000002243E020000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3128-342-0x0000000004D00000-0x0000000004D01000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/3312-177-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                        Filesize

                                                                        108KB

                                                                        Download

                                                                      • memory/3992-1091-0x00000271EDC00000-0x00000271EDD00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/3992-1097-0x00000271EEB30000-0x00000271EEB50000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3992-1108-0x00000271EEAF0000-0x00000271EEB10000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/3992-1128-0x00000271EF100000-0x00000271EF120000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4116-1235-0x00000000042E0000-0x00000000042E1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/4128-1239-0x00000233E0900000-0x00000233E0A00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4128-1247-0x00000233E19D0000-0x00000233E19F0000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4128-1261-0x00000233E1FE0000-0x00000233E2000000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4128-1242-0x00000233E1C20000-0x00000233E1C40000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4128-1237-0x00000233E0900000-0x00000233E0A00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4128-1238-0x00000233E0900000-0x00000233E0A00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4192-491-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/4236-73-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/4236-74-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                        Filesize

                                                                        428KB

                                                                        Download

                                                                      • memory/4380-186-0x0000000003290000-0x0000000003291000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/4432-1388-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/4444-1089-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/4460-940-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download

                                                                      • memory/4496-361-0x000001FFD8520000-0x000001FFD8540000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4496-375-0x000001FFD8920000-0x000001FFD8940000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4496-350-0x000001FFD8560000-0x000001FFD8580000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4820-510-0x000001B352720000-0x000001B352740000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4820-522-0x000001B352B30000-0x000001B352B50000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4820-499-0x000001B352760000-0x000001B352780000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4872-1390-0x000001E161900000-0x000001E161A00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4872-1392-0x000001E161900000-0x000001E161A00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/4872-1395-0x000001E162C60000-0x000001E162C80000-memory.dmp

                                                                        Filesize

                                                                        128KB

                                                                        Download

                                                                      • memory/4872-1391-0x000001E161900000-0x000001E161A00000-memory.dmp

                                                                        Filesize

                                                                        1024KB

                                                                        Download

                                                                      • memory/5024-790-0x00000000028D0000-0x00000000028D1000-memory.dmp

                                                                        Filesize

                                                                        4KB

                                                                        Download