Overview

overview

10

Static

static

3

7a39459b24...6N.exe

windows7-x64

10

7a39459b24...6N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    58s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-01-2025 22:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026N.exe

  • Size

    278KB

  • MD5

    063c7d5dccfda3e0b0ad858820e32060

  • SHA1

    4aae1fc23e48804b98a778f1b2786ffa05e3a689

  • SHA256

    7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026

  • SHA512

    f04bff72be28e76e729a8cadfa726f45803847899f58b6dccdf1853b647520be9cc80b4ab6c409f6f0db589b8f78d2ccf7d6fc6ea639d7bfbe7e1f3ffc7f17ef

  • SSDEEP

    6144:lgRqbGn6NH+qcEDlCC/R4eilAZ88K8snV7mv+Juo:l+qbGceGlD/yeLZV4A2Ju

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026N.exe
    "C:\Users\Admin\AppData\Local\Temp\7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026N.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026N.exe
      C:\Users\Admin\AppData\Local\Temp\7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026N.exe startC:\Users\Admin\AppData\Roaming\A2259\6BE9E.exe%C:\Users\Admin\AppData\Roaming\A2259
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1400
    • C:\Users\Admin\AppData\Local\Temp\7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026N.exe
      C:\Users\Admin\AppData\Local\Temp\7a39459b2468d6f0dabd92d0ca72ffb58cf468792d075d6f75acd58732aef026N.exe startC:\Program Files (x86)\5910F\lvvm.exe%C:\Program Files (x86)\5910F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4356
    • C:\Program Files (x86)\LP\9E9A\3E0E.tmp
      "C:\Program Files (x86)\LP\9E9A\3E0E.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1864
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3536
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2608
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5072
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1904
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:516
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3656
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:3948
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3700
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3472
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4556
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3592
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2408
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1716
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2308
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4256
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1184
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4340
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4556
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4784
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3920
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4196
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2404
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:1480
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:1776
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4720
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3392
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4808
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:5064
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2576
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4092
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:5020
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:1712
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:5052
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4560
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4408
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2972
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4200
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4588
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:3636
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4720
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1604
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4956
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1500
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3868
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3588
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3164
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4184
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:2352
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:1840
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:4212
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4672
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3688
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:2888
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:2440
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4864
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3840
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:4016
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:4720

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          2
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Create or Modify System Process

                                                                          1
                                                                          T1543

                                                                          Windows Service

                                                                          1
                                                                          T1543.003

                                                                          Privilege Escalation

                                                                          Boot or Logon Autostart Execution

                                                                          2
                                                                          T1547

                                                                          Active Setup

                                                                          1
                                                                          T1547.014

                                                                          Registry Run Keys / Startup Folder

                                                                          1
                                                                          T1547.001

                                                                          Create or Modify System Process

                                                                          1
                                                                          T1543

                                                                          Windows Service

                                                                          1
                                                                          T1543.003

                                                                          Defense Evasion

                                                                          Modify Registry

                                                                          5
                                                                          T1112

                                                                          Credential Access

                                                                          Credentials from Password Stores

                                                                          1
                                                                          T1555

                                                                          Credentials from Web Browsers

                                                                          1
                                                                          T1555.003

                                                                          Unsecured Credentials

                                                                          3
                                                                          T1552

                                                                          Credentials In Files

                                                                          3
                                                                          T1552.001

                                                                          Discovery

                                                                          Peripheral Device Discovery

                                                                          2
                                                                          T1120

                                                                          Query Registry

                                                                          4
                                                                          T1012

                                                                          System Information Discovery

                                                                          2
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          Lateral Movement

                                                                          Collection

                                                                          Data from Local System

                                                                          2
                                                                          T1005

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Program Files (x86)\LP\9E9A\3E0E.tmp
                                                                            Filesize

                                                                            99KB

                                                                            MD5

                                                                            55ce0a78d2d9f3b77a707191cbb289cc

                                                                            SHA1

                                                                            a45bfce1c2de0de0f3222f9e388a1d19a84c0c07

                                                                            SHA256

                                                                            1cd3bf36ce50f03435f912f72092a561a9106f92f1a94b6028db3012960c5c2a

                                                                            SHA512

                                                                            50727fd305ef36f6dc28a8a1a7f12df2e82e024a89be0d51e79e034c8de99fbf3a0c71b5578a0c1171296724e7c39121443d2568b62edc4ef5a75da626e7b319

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                            Filesize

                                                                            471B

                                                                            MD5

                                                                            099cec3daf6c8b40cd9202ac854db03e

                                                                            SHA1

                                                                            9cd799dacdfffd54ec2379b375eedfc233719876

                                                                            SHA256

                                                                            5066c81360e6624f3d818b28173d8861ae4527e542b4b3f17bf426eab079ebf2

                                                                            SHA512

                                                                            b4e742f28d4c0e150a71ffdc2c12172bd8b64d48d019d76fc201d9a6704f09f391c8952b215ce7ec64995a81ca4c06ec8b29d3c9143ced8dcae30b3ae422d667

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                            Filesize

                                                                            412B

                                                                            MD5

                                                                            3190685ae8483f9130a0df457fe0cf39

                                                                            SHA1

                                                                            a227a57dc25939c30e84989c55fa787d8d5f83ec

                                                                            SHA256

                                                                            dbf4f4deb6a5d977f407716033b002bb1b9ff873c400cd3cf634b1e004e56dfc

                                                                            SHA512

                                                                            e77ab805bb7dc02b2ef8ed0680f288e16aa8149453826e62e51d102c8dca8ad183f4f8430cb58d604fe0b2cde557500cc6f0611e0282c4f2be9051ab565630e6

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            843b7c2ce4ca66bdad271fcb074944db

                                                                            SHA1

                                                                            fd3845d3b71aaee91b1c3056ccc45362faa0abeb

                                                                            SHA256

                                                                            59ccadf1116a173e8bad3fb167f1cf52e2fc8f33dd7f35bbcb10a53228d5f9ed

                                                                            SHA512

                                                                            7c9d2a6285e589067cfa2675bf5921d4a312820b522e712e6afd290b6ff8c0598db34ac63bc8dfa7059b97395eeb8f8385a8606c8a86dc7cef7a53e6b226de52

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80GI1ZH7\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            742f1cda58883699ef753f83244412ce

                                                                            SHA1

                                                                            38531f396e1d9dc9ba6bba0604149c377605f57a

                                                                            SHA256

                                                                            5ef67927e9fdebb14515728d51548c52536519b35b5a52728ca1d660d957025f

                                                                            SHA512

                                                                            11acf77cd15052ae9cf554ab666f6c1e629e174fad16659738a11bee6a53b857f375fe99701e7c14c14286193864449f5b88a208ff34f4874e8351dff6a3a6f2

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\A2259\910F.225
                                                                            Filesize

                                                                            600B

                                                                            MD5

                                                                            9ae11a33e81f30c02461c9454bfd03c2

                                                                            SHA1

                                                                            72b498fcbb3592106d5c742b67bf08169106ab85

                                                                            SHA256

                                                                            3381aad5d4f19b0532b8d04f0f00b5f11dea54f5304d92226914bc27e0d8af21

                                                                            SHA512

                                                                            d4c6e72587b90983201d426eb62860569ae169870d8171864b99203097a1d46fa205795245260411b9cdb3965657aa80efd620ed2094a8dfdc017e1229b82972

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\A2259\910F.225
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            7a7e5a63736091ab3ffb9e76537e99f6

                                                                            SHA1

                                                                            fad3042151f454b0887ff02672ce3a1a85d5e520

                                                                            SHA256

                                                                            73148a53b90ddafc0171c0b9f575e244839bbeb316b093c044c0b4212cf10ec2

                                                                            SHA512

                                                                            2efd434afad7a04112743bc4b4c656210f0ea3b82fd4adf2ab71d05351f19c0b0b824e9523afac71d82b2133793567458765048d9bcee26db532ea924e0f2e29

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\A2259\910F.225
                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            910e2d9668aa0b157d9fe0f69acade32

                                                                            SHA1

                                                                            c54359e3fc703a16c679544ca72678fffd6d75cb

                                                                            SHA256

                                                                            6c07b86b1123a4968180de366519230b6ace948ff27fbc7b2dd57a876792319b

                                                                            SHA512

                                                                            f9dae7e62995010160d6ffc497e43ca738f8b2b71db1649b9aac37763ac3d945e5087dfe2cb3359572cba046048dbdc16cd47d1bb20a98d9543d9b42217d2825

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\A2259\910F.225
                                                                            Filesize

                                                                            996B

                                                                            MD5

                                                                            bd5c0bd6e30de3996251bfec588460ec

                                                                            SHA1

                                                                            08c136f4f8cbc6d307695a96f86356bba2bb0ca3

                                                                            SHA256

                                                                            70bc9efb0bd6b55bd9ed77446e76f3505cf35a5cb759dbe024809d596b3535b5

                                                                            SHA512

                                                                            100110003f04a922287d7b459b88b0c9304017dbc727425d1ece3cdf80389f8645875fb96192581c95d3abfa7d14286addb1091f23165efd61731c91d5c808fc

                                                                            Download Submit

                                                                          • memory/1184-783-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/1400-16-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/1400-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/1716-651-0x0000000004000000-0x0000000004001000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/1776-1098-0x0000022558900000-0x0000022558920000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1776-1109-0x0000022558D10000-0x0000022558D30000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1776-1085-0x0000022558940000-0x0000022558960000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1864-617-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                            Filesize

                                                                            112KB

                                                                            Download

                                                                          • memory/1904-188-0x00000000033D0000-0x00000000033D1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/2320-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                            Download

                                                                          • memory/2320-618-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/2320-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                            Filesize

                                                                            416KB

                                                                            Download

                                                                          • memory/2320-1368-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/2320-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/2320-80-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/2320-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/2404-1078-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/2408-503-0x0000020A2E840000-0x0000020A2E940000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/2408-519-0x0000020A2F950000-0x0000020A2F970000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2408-539-0x0000020A2FD60000-0x0000020A2FD80000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2408-507-0x0000020A2F990000-0x0000020A2F9B0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2408-502-0x0000020A2E840000-0x0000020A2E940000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3472-380-0x0000013AFE390000-0x0000013AFE3B0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3472-367-0x0000013AFDF80000-0x0000013AFDFA0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3472-357-0x0000013AFDFC0000-0x0000013AFDFE0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3472-353-0x0000013AFCF00000-0x0000013AFD000000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3472-352-0x0000013AFCF00000-0x0000013AFD000000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3656-209-0x0000021307000000-0x0000021307020000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3656-226-0x0000021307410000-0x0000021307430000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3656-195-0x0000021307040000-0x0000021307060000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3656-192-0x0000021306130000-0x0000021306230000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3656-190-0x0000021306130000-0x0000021306230000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/3948-340-0x0000000004930000-0x0000000004931000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4092-1373-0x00000205D8700000-0x00000205D8800000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4092-1371-0x00000205D8700000-0x00000205D8800000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4196-971-0x00000270D9110000-0x00000270D9130000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4196-939-0x00000270D8D40000-0x00000270D8D60000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4196-953-0x00000270D8D00000-0x00000270D8D20000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4256-678-0x0000022292AC0000-0x0000022292AE0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4256-667-0x00000222924A0000-0x00000222924C0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4256-658-0x00000222924E0000-0x0000022292500000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4256-653-0x0000022291600000-0x0000022291700000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4256-654-0x0000022291600000-0x0000022291700000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4256-655-0x0000022291600000-0x0000022291700000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4356-82-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                            Filesize

                                                                            428KB

                                                                            Download

                                                                          • memory/4556-785-0x0000020FA6A00000-0x0000020FA6B00000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4556-799-0x0000020FA77C0000-0x0000020FA77E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4556-786-0x0000020FA6A00000-0x0000020FA6B00000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4556-790-0x0000020FA7B00000-0x0000020FA7B20000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4556-811-0x0000020FA7ED0000-0x0000020FA7EF0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4556-500-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4556-787-0x0000020FA6A00000-0x0000020FA6B00000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4720-1219-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4784-932-0x00000000040A0000-0x00000000040A1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4808-1222-0x000001AB04F00000-0x000001AB05000000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/4808-1238-0x000001AB05CA0000-0x000001AB05CC0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4808-1250-0x000001AB062C0000-0x000001AB062E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4808-1226-0x000001AB05CE0000-0x000001AB05D00000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4808-1221-0x000001AB04F00000-0x000001AB05000000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                            Download

                                                                          • memory/5064-1370-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download