Overview

overview

10

Static

static

3

9622985773...3N.exe

windows7-x64

10

9622985773...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    56s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2024 20:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3N.exe

  • Size

    283KB

  • MD5

    50dcf731699b37be03f91be86c617290

  • SHA1

    db4769a1995569c09e57c1ae365d47563638d419

  • SHA256

    9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3

  • SHA512

    fd036efb4d2d71cb491aae3d7e214e94aae93792fd4da8ab11704cb50a390a07fdd4ea95bb4aee2c42dd0903556d7a23bbf81a1429f5531a32b8d8620f090825

  • SSDEEP

    6144:ErPrgEYF57R69Um+nEY0kqk4PXzCPamiHtRNCI6X:ugXF9R6ym+skK07mKX

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3N.exe
    "C:\Users\Admin\AppData\Local\Temp\9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3N.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3N.exe
      C:\Users\Admin\AppData\Local\Temp\9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3N.exe startC:\Users\Admin\AppData\Roaming\6FD5A\447F0.exe%C:\Users\Admin\AppData\Roaming\6FD5A
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2588
    • C:\Users\Admin\AppData\Local\Temp\9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3N.exe
      C:\Users\Admin\AppData\Local\Temp\9622985773330132aabb5d01f34e72e78390062e86a2a1c4d0113aef5ba470a3N.exe startC:\Program Files (x86)\5AA97\lvvm.exe%C:\Program Files (x86)\5AA97
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4472
    • C:\Program Files (x86)\LP\F0B6\F26E.tmp
      "C:\Program Files (x86)\LP\F0B6\F26E.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4308
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2224
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3636
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3952
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3212
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2092
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3380
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5020
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1432
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3212
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:556
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4724
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1036
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:2076
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2976
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3572
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4312
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3892
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4764
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Modifies registry class
    PID:3120
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3436
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1648
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3000
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4604
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3732
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:3300
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3464
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4264
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3800
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:516
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:2668
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:2540
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3608
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:1920
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:2108
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2448
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:1272
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3212
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3892
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4212
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4208
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:864
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:5000
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1744
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3728
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1460
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3628
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3476
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4424
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3184
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:1744
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:1564
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4388
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3180
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3588
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4800
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:3148
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:4000
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4264

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Active Setup

                                                                                1
                                                                                T1547.014

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Active Setup

                                                                                1
                                                                                T1547.014

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Defense Evasion

                                                                                Modify Registry

                                                                                5
                                                                                T1112

                                                                                Credential Access

                                                                                Credentials from Password Stores

                                                                                1
                                                                                T1555

                                                                                Credentials from Web Browsers

                                                                                1
                                                                                T1555.003

                                                                                Unsecured Credentials

                                                                                3
                                                                                T1552

                                                                                Credentials In Files

                                                                                3
                                                                                T1552.001

                                                                                Discovery

                                                                                Peripheral Device Discovery

                                                                                2
                                                                                T1120

                                                                                Query Registry

                                                                                4
                                                                                T1012

                                                                                System Information Discovery

                                                                                2
                                                                                T1082

                                                                                System Location Discovery

                                                                                1
                                                                                T1614

                                                                                System Language Discovery

                                                                                1
                                                                                T1614.001

                                                                                Lateral Movement

                                                                                Collection

                                                                                Data from Local System

                                                                                2
                                                                                T1005

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Program Files (x86)\LP\F0B6\F26E.tmp
                                                                                  Filesize

                                                                                  99KB

                                                                                  MD5

                                                                                  9d83b6d4629b9d0e96bbdb171b0dc5db

                                                                                  SHA1

                                                                                  e9bed14c44fe554e0e8385096bbacca494da30b1

                                                                                  SHA256

                                                                                  d3a6060ff059a7724a483d82025a9231a61143839b633a6d3842a58ccb5a7d7d

                                                                                  SHA512

                                                                                  301187bdcab5ca9942b2c7b7114e37e53e58b5661eef50c389622950d7691993a29f5a825132cf499ca73cdb6637d3f58afdc024cb04fac2b8e01f752209572c

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                  Filesize

                                                                                  471B

                                                                                  MD5

                                                                                  731923ffb5923b45e180327093aaaae0

                                                                                  SHA1

                                                                                  4dd712c46221c2861c6b65a6d2013dd3136e0aa0

                                                                                  SHA256

                                                                                  ea388e679c400ae4a209d8f2c07aa35abca71900d64a0b63380613340c919314

                                                                                  SHA512

                                                                                  925483b7f52950c63303b4b65bca42c1d3885066f5af7cd318aa1b71ba42afb9d6e7bc21876a7e5b254a4f569b58116f510919aa291aae2936ad5ca38d805df6

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                  Filesize

                                                                                  412B

                                                                                  MD5

                                                                                  2f094f994b25f08ad0244a00cad75d22

                                                                                  SHA1

                                                                                  ee33852d7d0378c0941592e10951ddc7c7db1e9d

                                                                                  SHA256

                                                                                  291e09051426b746ecc3b5b6e06f775e7a7f88d20c18f3c8001df353759e6a7f

                                                                                  SHA512

                                                                                  cbb05f1c826e68b4805551c7d2a6236a3942e9f8f621dd6d6233582b6b72c841f90b9f5a5c1ac76f83ee50fb29438ce1a28a6ba092f55ef8b1015a75eed6c9c5

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  6b1719ed74911e95a670c29d4214337f

                                                                                  SHA1

                                                                                  243a694dcec8148915e490a246547cf7c4e35e9a

                                                                                  SHA256

                                                                                  65de2fcb454cb54070d09c2184335338b8cfcb94816d48e3cafa39eb15376e4a

                                                                                  SHA512

                                                                                  193ba819fb4ae709edb0d5f6789fc9b1ec50e9e211fef120e1cd8b0cc5ec6587a740efb32931588d3fdd5ff1d0913da5ce022a79be78d8a34b59a09588303773

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YCLWQ4BV\microsoft.windows[1].xml
                                                                                  Filesize

                                                                                  97B

                                                                                  MD5

                                                                                  781c2d6d1f6f2f8ae243c569925a6c44

                                                                                  SHA1

                                                                                  6d5d26acc2002f5a507bd517051095a97501931b

                                                                                  SHA256

                                                                                  70687e419879f006d0c50c08657c66b1187b94ea216cfe0a2e6be8bd2de77bc8

                                                                                  SHA512

                                                                                  3599fa8f2ffe140a8f68ec735810d24a5b367a9a551d620baa6dc611ca755dce1a662bf22b90f842d499d2c9530fb8acd634d1654d5e2c1b319574cbf35eadf7

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6FD5A\AA97.FD5
                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  417da1bc7a106fb7c608997db1a8ff63

                                                                                  SHA1

                                                                                  c26357325c076db36462fd0eaca50f6bed14b395

                                                                                  SHA256

                                                                                  fdb91fde8581971afa898c52e0cbae2b7cba21a5200045dddce0497792efe34b

                                                                                  SHA512

                                                                                  4d0813d54ea7f4fac05adef031815150b52b744a6ca4f17fe9881b74fe71f6e69d20b0c48b01073af771324b18848f1409006c427d77db1c20570456d701f9f4

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6FD5A\AA97.FD5
                                                                                  Filesize

                                                                                  600B

                                                                                  MD5

                                                                                  7938fb46f8d7137773cea2443be11a6a

                                                                                  SHA1

                                                                                  66562e7aedad0732d4c8052b39523acf7ec156c8

                                                                                  SHA256

                                                                                  c72d2de0b46a07f56f29424c57a6164c74f1337a96b2a4f74ddf4d73b9493ae9

                                                                                  SHA512

                                                                                  5eab0ca00e38f51f15241c34ef0ec5e6a6f52c9d688d060b2cb6bd5c3c7670d916b18ddbe4ef57a9fbe7bb2362965d60abfaa6e06ad00351edde07ac63584dfa

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\6FD5A\AA97.FD5
                                                                                  Filesize

                                                                                  996B

                                                                                  MD5

                                                                                  15003f46eba47610dce1ce91f87745e5

                                                                                  SHA1

                                                                                  83e78969f231fba9c2b8e7bf66ce868955686615

                                                                                  SHA256

                                                                                  781e3fb0a22e1abe9570ff77a4b9e772a0b6e3334f83ca3074d235c1e906ee15

                                                                                  SHA512

                                                                                  1be30cc09150b55236a54d0f05b43157f7d38925cc04fa0a89219f2552e13095474aa52a4a53b2b22a82c5d8e61d3d1b173e80cac6bdd134e8c7f459ddc52652

                                                                                  Download Submit

                                                                                • memory/556-496-0x0000000004770000-0x0000000004771000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1036-499-0x00000293D5940000-0x00000293D5A40000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1036-498-0x00000293D5940000-0x00000293D5A40000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1036-500-0x00000293D5940000-0x00000293D5A40000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1036-527-0x00000293D6E80000-0x00000293D6EA0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1036-515-0x00000293D6860000-0x00000293D6880000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1036-503-0x00000293D68A0000-0x00000293D68C0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1432-352-0x0000000004060000-0x0000000004061000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1648-969-0x000001FFC65C0000-0x000001FFC65E0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1648-955-0x000001FFC61B0000-0x000001FFC61D0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1648-947-0x000001FFC61F0000-0x000001FFC6210000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1920-1548-0x000001F97A100000-0x000001F97A200000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1920-1563-0x000001F97B1B0000-0x000001F97B1D0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1920-1549-0x000001F97A100000-0x000001F97A200000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1920-1550-0x000001F97A100000-0x000001F97A200000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1920-1553-0x000001F97B1F0000-0x000001F97B210000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2076-638-0x00000000048D0000-0x00000000048D1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2092-186-0x00000000040C0000-0x00000000040C1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2540-1546-0x0000000004B90000-0x0000000004B91000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2588-17-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/2588-14-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/2588-15-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/2668-1413-0x000001EF49260000-0x000001EF49280000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2668-1433-0x000001EF49670000-0x000001EF49690000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2668-1402-0x000001EF492A0000-0x000001EF492C0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3000-1089-0x0000000004300000-0x0000000004301000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3120-939-0x00000000048E0000-0x00000000048E1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3300-1241-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3572-677-0x00000188838A0000-0x00000188838C0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3572-645-0x00000188832D0000-0x00000188832F0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3572-656-0x0000018883290000-0x00000188832B0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3732-1107-0x000001EF34260000-0x000001EF34280000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3732-1096-0x000001EF342A0000-0x000001EF342C0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3732-1128-0x000001EF34670000-0x000001EF34690000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3732-1091-0x000001EF33140000-0x000001EF33240000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/3732-1093-0x000001EF33140000-0x000001EF33240000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/3800-1395-0x0000000004550000-0x0000000004551000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4108-354-0x00000253C3B00000-0x00000253C3C00000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4108-371-0x00000253C4D90000-0x00000253C4DB0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4108-382-0x00000253C51A0000-0x00000253C51C0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4108-359-0x00000253C4DD0000-0x00000253C4DF0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4108-355-0x00000253C3B00000-0x00000253C3C00000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4264-1248-0x000001C68D380000-0x000001C68D3A0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4264-1273-0x000001C68D750000-0x000001C68D770000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4264-1261-0x000001C68D340000-0x000001C68D360000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4296-1-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                  Filesize

                                                                                  420KB

                                                                                  Download

                                                                                • memory/4296-2-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/4296-11-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/4296-12-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                                  Filesize

                                                                                  420KB

                                                                                  Download

                                                                                • memory/4296-83-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/4296-494-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/4296-1392-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/4308-350-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                  Filesize

                                                                                  112KB

                                                                                  Download

                                                                                • memory/4312-788-0x00000000041E0000-0x00000000041E1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4472-85-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                  Download

                                                                                • memory/4764-789-0x0000020A66320000-0x0000020A66420000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4764-806-0x0000020A67440000-0x0000020A67460000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4764-818-0x0000020A67850000-0x0000020A67870000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4764-794-0x0000020A67480000-0x0000020A674A0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4764-790-0x0000020A66320000-0x0000020A66420000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/5020-223-0x000001DB17350000-0x000001DB17370000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/5020-222-0x000001DB16F40000-0x000001DB16F60000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/5020-192-0x000001DB16F80000-0x000001DB16FA0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download