Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 14:58

General

  • Target

    83614e5bac3d1d567e94ac46bb60ea2d_JaffaCakes118.exe

  • Size

    823KB

  • MD5

    83614e5bac3d1d567e94ac46bb60ea2d

  • SHA1

    c9812f1f26689573ee77744a7d5528a398531705

  • SHA256

    fc605c16e47cde8d5f5d860e82fe5bd365d7c81410d71aa6c590b6c093bf216f

  • SHA512

    e14d5921f7d052c473a51a6de1d03929f32249eb8d8dd193f60fcaf57f5d622681750d3e1632450d5ea41408f073b159f7cbffeb8c18b230edb77b6172544245

  • SSDEEP

    24576:tqd2QEshy188oX/RsDipdD0NIZMoXGuH1:nQEshWMPRsGpN0+ZJX

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 29 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\83614e5bac3d1d567e94ac46bb60ea2d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\83614e5bac3d1d567e94ac46bb60ea2d_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1372
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2368
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4160
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4224
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4020
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:396
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3964
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SendNotifyMessage
        PID:4200
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:3624
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1196
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
        1⤵
          PID:2072
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:1892
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3204
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2908
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Modifies registry class
            PID:1836
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:1804
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:2736
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3732
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3916
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:2292
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:4276
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Modifies registry class
            PID:3740
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:1916
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1792
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies registry class
              PID:3136
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Boot or Logon Autostart Execution: Active Setup
              PID:4840
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Boot or Logon Autostart Execution: Active Setup
              PID:2332
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Boot or Logon Autostart Execution: Active Setup
              PID:3044
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4116
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                PID:3772
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies registry class
                PID:3824
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:1876
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:660
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:2880
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:1328
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:1312
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:3424
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Modifies registry class
                PID:3068
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Boot or Logon Autostart Execution: Active Setup
                PID:3684
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3940
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies registry class
                  PID:4488
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4432
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:888
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:2920
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:736
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:2212
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:2472
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:4604
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:3676
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:648
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:3300
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:4236
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:1060
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Modifies registry class
                    PID:1696
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:4264
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:4416
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:4220
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:1544
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:3308
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:3572
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    PID:4184
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:3716
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:1496
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Modifies registry class
                    PID:4312
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4736
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Modifies registry class
                      PID:4612
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      PID:2912
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Modifies registry class
                      PID:1896
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:2096
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies registry class
                        PID:5096
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Modifies registry class
                        PID:2680
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        PID:2100
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Modifies registry class
                        PID:1080
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        PID:1660
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Modifies registry class
                        PID:1288
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        PID:2964
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Modifies registry class
                        PID:452
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies registry class
                        PID:3888
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3180
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies registry class
                          PID:4296
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          PID:3768
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Modifies registry class
                          PID:2352
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Modifies registry class
                          PID:1012
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Modifies registry class
                          PID:388
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          PID:3656
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies registry class
                          PID:4992
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          PID:1908
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          PID:4480
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Modifies registry class
                          PID:2772
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          PID:5060
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies registry class
                          PID:3168
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          PID:1820
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3032
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            PID:4756
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            PID:3808
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            PID:3284
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:2572
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3408
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4292
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:2824
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3776
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4964
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4136
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2160
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:636
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4660
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2232
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:2456
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:2480
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:1532
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3348
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4168
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3716
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4112
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4468
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2156
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:3640
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:2120
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3984
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2960
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2184
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4396
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:180
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:916
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:2428
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:712
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2616
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:4980
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:400
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:5040
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:3672
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3216
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:4704
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:4284
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:2976
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:4232
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:4084

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                    Filesize

                                                                                                                    471B

                                                                                                                    MD5

                                                                                                                    c11671674643d73cae76b5717704ee8a

                                                                                                                    SHA1

                                                                                                                    a93b6f870418e27e36b284333045c5c7264d3c47

                                                                                                                    SHA256

                                                                                                                    6e2b6aff8c7cd0c948d2f2b5653a7126f791fe8c0462ef6498e36912085dd145

                                                                                                                    SHA512

                                                                                                                    c4111ad849754d14b4c6f02a860683c0c141b020ba3a9f09a1595a6be1d7c1d3bbd4669cfc8436d7862cd72e1f9fa39d70c45d8e84c2272d3c779c03be8d5840

                                                                                                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                                                                                                    Filesize

                                                                                                                    412B

                                                                                                                    MD5

                                                                                                                    b065f9377ee42c8b2f65247f4ec5eac9

                                                                                                                    SHA1

                                                                                                                    2b667e7ef0494dc862901f92a07f96c2f83de648

                                                                                                                    SHA256

                                                                                                                    a01a3bfd40b97b0bef2d96fc5fec1ac8b4a0b28643c5f961b3a63cfa3e65bf15

                                                                                                                    SHA512

                                                                                                                    b403bf927266efa112903d062da0d9ba2a8022f7af8c25449221837a2356f5c97a67b6d15a10cd4d7c87dd199804295cd6a3931057f66f20a476c7d179efc4e3

                                                                                                                  • C:\Users\Admin\AppData\Local\IconCache.db

                                                                                                                    Filesize

                                                                                                                    15KB

                                                                                                                    MD5

                                                                                                                    e3ef5db25a9b6f83e81fb75dbd26e397

                                                                                                                    SHA1

                                                                                                                    79b6f1fb9f55b3400bcadd8a179169bcd25cb8ab

                                                                                                                    SHA256

                                                                                                                    87d7b10f1ec230cff2d357b77b8cdd816428e4efca06e0a77dd2f295aa4e4280

                                                                                                                    SHA512

                                                                                                                    04350f3650e857309dc0698bb73154f8090bcd34c98f44e7893fd7f0c16b5fe6c47c605126d6e1f98911a8901b3a2c68dad98d286bf4c340f1a9be36426e0cfd

                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                                                    Filesize

                                                                                                                    1022B

                                                                                                                    MD5

                                                                                                                    83ccd2314306cd9c5cb88cc8636efb71

                                                                                                                    SHA1

                                                                                                                    9ee4d2cd6407025114eec0ad89770226268d56b9

                                                                                                                    SHA256

                                                                                                                    d9eeb91afb3512c1a8d86c692eba99d0e554bd712af5a7fe8088eceb68e76b09

                                                                                                                    SHA512

                                                                                                                    cd8a916e276e09f222f7ec89ac9b36d46cbcbf1427dad258f99bcbf46c3204048b1af626f5c50115077e6a5c38a5cb42174d0ffa0b601a58bd6a97d361b6cd38

                                                                                                                  • memory/396-17-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1196-29-0x0000000004640000-0x0000000004641000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1372-27-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-33-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-45-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-5-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-4-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-18-0x00000000009F1000-0x00000000009F2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1372-19-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-3-0x00000000009F1000-0x00000000009F2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1372-0-0x0000000002DE0000-0x0000000002DE9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB

                                                                                                                  • memory/1372-26-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-1-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-13-0x0000000002DE0000-0x0000000002DE9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB

                                                                                                                  • memory/1372-34-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-35-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-36-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-37-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-38-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-39-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-40-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-41-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-42-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-43-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/1372-44-0x0000000000400000-0x0000000000A13000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.1MB

                                                                                                                  • memory/4224-11-0x00000000029E0000-0x00000000029E1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB