Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 21:47

General

  • Target

    078cf928167301554726a6af8f53d082_JaffaCakes118.exe

  • Size

    275KB

  • MD5

    078cf928167301554726a6af8f53d082

  • SHA1

    d36e949908407dd7cadef0c0167b377321e337b0

  • SHA256

    f1b6e11622a33f734bd008dd1502b94404eff6bba304a316c42bac7156e12264

  • SHA512

    fd2acd9d7d66cf9771289955d3435203c7ef103bfea25b7a10a9aa93b2012ec0538ae9777800c40282e9a7b43484c3619def237bad4469015f1f19704ac33a5d

  • SSDEEP

    6144:AB/ImQ7AKAiBmU9fvIJw5Gle2rRBL8+bw+MH:y/IUChNwJbe2rRZ8+LM

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables taskbar notifications via registry modification
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\078cf928167301554726a6af8f53d082_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\078cf928167301554726a6af8f53d082_JaffaCakes118.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2820
    • C:\Users\Admin\AppData\Local\Temp\078cf928167301554726a6af8f53d082_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\078cf928167301554726a6af8f53d082_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\A7B76\0D11A.exe%C:\Users\Admin\AppData\Roaming\A7B76
      2⤵
        PID:3628
      • C:\Users\Admin\AppData\Local\Temp\078cf928167301554726a6af8f53d082_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\078cf928167301554726a6af8f53d082_JaffaCakes118.exe startC:\Program Files (x86)\7689D\lvvm.exe%C:\Program Files (x86)\7689D
        2⤵
          PID:4504
        • C:\Program Files (x86)\LP\1AAA\148D.tmp
          "C:\Program Files (x86)\LP\1AAA\148D.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4420
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2588
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2320
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4228
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4020
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4160
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2120
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2012
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3988
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:1176
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3716
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2900
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2032
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:560
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1264
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4408
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4228
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4796
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4932
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3348
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3976
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3224
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4988
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1944
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:5020
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4288
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4044
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4864
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2320
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4652
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:444
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1808
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1876
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2384
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2784
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4680
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3692
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3324
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3688
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:5084
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:1408
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3648
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:848
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3616
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3716
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3628
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2012
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:1232
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2948
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4428
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:4780
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:1584
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3964
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:2016
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:316
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2512
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:5020
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4048
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:1944
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:844
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4228
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:4148
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4220
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2600
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                  1⤵
                                                                                    PID:1160
                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                    1⤵
                                                                                      PID:4392
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4004
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                        1⤵
                                                                                          PID:540
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:3328
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:396
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                                PID:2828
                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                1⤵
                                                                                                  PID:4700
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3292
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:312
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                      1⤵
                                                                                                        PID:4836

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Program Files (x86)\LP\1AAA\148D.tmp

                                                                                                        Filesize

                                                                                                        98KB

                                                                                                        MD5

                                                                                                        7bcdd69e096631aa9d2ed6740fea7003

                                                                                                        SHA1

                                                                                                        f9e3911cf42623317a3a2dca1b7c42eef691f106

                                                                                                        SHA256

                                                                                                        3266d081c78f984aa74c555ba61b7f2d80ee98d657cce2e4ce3bd9cd8e77de63

                                                                                                        SHA512

                                                                                                        e1d4b814d1ebab64b43fc074e2dea0fa7af01856cf5fdef52b1687095263af65d6d06ad0589fe51da2ee5c496be5e3ac1195a54af26f0c3f9f2c93057de755d5

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                        Filesize

                                                                                                        471B

                                                                                                        MD5

                                                                                                        f83dc6d29ec51c15a555c8af37d3cb10

                                                                                                        SHA1

                                                                                                        240e381ff41a884a2a2d531a2f45c583c639a8c8

                                                                                                        SHA256

                                                                                                        564c573f762157ba3d34ded55ac2662acc58110eba0c42a2be6ccd586dce8a8b

                                                                                                        SHA512

                                                                                                        0a0c5b3744365a534259557d2e26cc35dbf7fb251b348686b60a33c231e2d8513e40f2501935550effab3e5ab39ab4addeb7880136b8623a2ff6ee0243a0d0c6

                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

                                                                                                        Filesize

                                                                                                        420B

                                                                                                        MD5

                                                                                                        c1585807675d7aab99db5ab32589f2c9

                                                                                                        SHA1

                                                                                                        4b31d13a014b3a4cb686552e78fa125945e5b10d

                                                                                                        SHA256

                                                                                                        9466e1d0b03b1110988a61ebcdc0e24281da85e16967d594f73282d994c97604

                                                                                                        SHA512

                                                                                                        152e8646e52012c76b979d96bc5ec24e175fccf663411d4b885295c0a5bc795a4979ed7c26c2ac4931a71176763cfc3116179794918aba94fda4db6026f64f31

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        7cde72d75dbd3c38860c142dd0cd99b1

                                                                                                        SHA1

                                                                                                        415e26b228dca5640b8d9dc848bc5ce64b002d8f

                                                                                                        SHA256

                                                                                                        1c97d286b4b9303114bcfbbbc5a92ca959f29a4caff13b349693dc6a8c8180bf

                                                                                                        SHA512

                                                                                                        5c6e5b7bc00d77e4287ca2565c9623482923f89537522344f1af8e53a9d32d6a8ad85516d71a8221349aa1843f9a7a000f418f9b9d928935eee3d7c3e2faa74a

                                                                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VJ9UXBET\microsoft.windows[1].xml

                                                                                                        Filesize

                                                                                                        97B

                                                                                                        MD5

                                                                                                        d28bf9e615b97abc4f63418e57cc40bc

                                                                                                        SHA1

                                                                                                        65885f634c0b15cabd1caf45861e7767f3110e44

                                                                                                        SHA256

                                                                                                        92e5c802db2c618a0c0aec072bec43479f082c95f35157b117749fee0ec295f7

                                                                                                        SHA512

                                                                                                        23e0b838c4a4a91b117fa0292e0350d691aa78eda49299819aa684efd6c6ec03b73a7d231996cf4d7e6cd10311a4755b5a434cae732c6376276290cb52f12eb0

                                                                                                      • C:\Users\Admin\AppData\Roaming\A7B76\689D.7B7

                                                                                                        Filesize

                                                                                                        1KB

                                                                                                        MD5

                                                                                                        f1d7fad0a439d2e38293c94645799597

                                                                                                        SHA1

                                                                                                        a722445435f883ef5b44e28a288e7c049069f932

                                                                                                        SHA256

                                                                                                        c8362b46c98c338d32d32256468f857e0c49fbfa0621de0ccf45ba36c787af41

                                                                                                        SHA512

                                                                                                        5d067f1b6bdab00918f5ddabe70f83f671fa43c2bae1829a585370f593226e9a67ea02f10aa8771d4495e8b3fb6f284689b38e834e90be1e56ab127a0dac6e3d

                                                                                                      • C:\Users\Admin\AppData\Roaming\A7B76\689D.7B7

                                                                                                        Filesize

                                                                                                        600B

                                                                                                        MD5

                                                                                                        341835aa1037da7f66a219b353975f3d

                                                                                                        SHA1

                                                                                                        758fa03603a6bf30bdd4970054373abb57568bd3

                                                                                                        SHA256

                                                                                                        d715b8ed646836b29afed272689bc2e68a834c982b8d75ef0498787b874c8dd3

                                                                                                        SHA512

                                                                                                        5d01ac6fefe3dd902beb4c7ea85b0992ba1b6103ebea4656362b58369c7ebf2cfcbf2e417c91aa21c80df587f4e6b773855f60f28e0159fdc39dfe3182546ab3

                                                                                                      • C:\Users\Admin\AppData\Roaming\A7B76\689D.7B7

                                                                                                        Filesize

                                                                                                        996B

                                                                                                        MD5

                                                                                                        ab3f950ef4f50275633fab6ecb4911a0

                                                                                                        SHA1

                                                                                                        c53c68b91eb06fdbe3f1a2e7f4313eb5d60860f8

                                                                                                        SHA256

                                                                                                        56c68e2085299180100075d2724911f1531bbb6d3af62ff1fd744282edb4fff7

                                                                                                        SHA512

                                                                                                        734123c7ef2681646204a46f6de42a88a638b7bef7b8d2aa299c213e09738086cce4b957391bb342af4fad53626eba566af77841bc606cc1c479d60b5d0aaa8f

                                                                                                      • memory/1176-344-0x0000000004080000-0x0000000004081000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/1264-499-0x00000233E3920000-0x00000233E3940000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1264-531-0x00000233E3CF0000-0x00000233E3D10000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1264-494-0x00000233E2800000-0x00000233E2900000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1264-508-0x00000233E35E0000-0x00000233E3600000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1944-948-0x000001FFB6E20000-0x000001FFB6E40000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1944-934-0x000001FFB5D00000-0x000001FFB5E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1944-936-0x000001FFB5D00000-0x000001FFB5E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1944-935-0x000001FFB5D00000-0x000001FFB5E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/1944-939-0x000001FFB6E60000-0x000001FFB6E80000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/1944-961-0x000001FFB7230000-0x000001FFB7250000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2032-492-0x0000000004170000-0x0000000004171000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2120-187-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/2820-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/2820-15-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                        Filesize

                                                                                                        416KB

                                                                                                      • memory/2820-154-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/2820-16-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/2820-77-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/2820-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                                        Filesize

                                                                                                        416KB

                                                                                                      • memory/2820-1228-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/2900-345-0x000002DB9B980000-0x000002DB9BA80000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2900-346-0x000002DB9B980000-0x000002DB9BA80000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/2900-350-0x000002E39DB00000-0x000002E39DB20000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2900-360-0x000002E39D7B0000-0x000002E39D7D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/2900-373-0x000002E39DEC0000-0x000002E39DEE0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3224-932-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/3628-12-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/3628-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/3628-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/3976-815-0x000001F178390000-0x000001F1783B0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3976-803-0x000001F177F80000-0x000001F177FA0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3976-788-0x000001F176F00000-0x000001F177000000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3976-789-0x000001F176F00000-0x000001F177000000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3976-793-0x000001F177FC0000-0x000001F177FE0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3988-189-0x00000215A74E0000-0x00000215A75E0000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/3988-194-0x00000215A8840000-0x00000215A8860000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3988-202-0x00000215A8800000-0x00000215A8820000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/3988-225-0x00000215A8C10000-0x00000215A8C30000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4044-1087-0x0000022619D00000-0x0000022619E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4044-1091-0x000002261ADE0000-0x000002261AE00000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4044-1103-0x000002261ADA0000-0x000002261ADC0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4044-1115-0x000002261B3B0000-0x000002261B3D0000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4044-1086-0x0000022619D00000-0x0000022619E00000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4408-641-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4420-153-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                        Filesize

                                                                                                        108KB

                                                                                                      • memory/4504-76-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                        Filesize

                                                                                                        428KB

                                                                                                      • memory/4652-1237-0x0000017F9F120000-0x0000017F9F140000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4652-1233-0x0000017F9E000000-0x0000017F9E100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4652-1232-0x0000017F9E000000-0x0000017F9E100000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4796-648-0x000001BC00D70000-0x000001BC00D90000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4796-644-0x000001C47FD20000-0x000001C47FE20000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4796-643-0x000001C47FD20000-0x000001C47FE20000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4796-670-0x000001BC01140000-0x000001BC01160000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4796-658-0x000001BC00D30000-0x000001BC00D50000-memory.dmp

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                      • memory/4796-645-0x000001C47FD20000-0x000001C47FE20000-memory.dmp

                                                                                                        Filesize

                                                                                                        1024KB

                                                                                                      • memory/4864-1230-0x0000000004390000-0x0000000004391000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/4932-786-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB

                                                                                                      • memory/5020-1084-0x0000000004B20000-0x0000000004B21000-memory.dmp

                                                                                                        Filesize

                                                                                                        4KB