Overview

overview

10

Static

static

3

JaffaCakes...c1.exe

windows7-x64

10

JaffaCakes...c1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-01-2025 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe

  • Size

    278KB

  • MD5

    64ec8c9f9ac8c458774ff323d8c549c1

  • SHA1

    1956d1504da927d007825a2fcaae7084d4f2ea45

  • SHA256

    210c003349ae00ec0e19c8ebbef379d336504027ba3a6a7c671e2e9d0ba737a7

  • SHA512

    0c5443cebf907129028ef01b32e6bfae146e2cb0cf07ebd8af0d24ba92170f5f8e485c9b3bd73bf3eea6a6fa1459e5db0d5f342da3b709312762e3f9c19f663e

  • SSDEEP

    6144:+H54+Ttb6qJKFWidMKVY3ef4nTNEgnicIeBQtbhx++/qwbG4YrdnSUGWIiO:ARtbzDKVY3eG9i0BQtn+IbBYrdSM

Score
10/10
cycbotbackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 8 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4264
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe startC:\Users\Admin\AppData\Roaming\DCC63\97B0B.exe%C:\Users\Admin\AppData\Roaming\DCC63
      2⤵
        PID:3220
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_64ec8c9f9ac8c458774ff323d8c549c1.exe startC:\Program Files (x86)\63EBD\lvvm.exe%C:\Program Files (x86)\63EBD
        2⤵
          PID:1192
        • C:\Program Files (x86)\LP\0B0D\147D.tmp
          "C:\Program Files (x86)\LP\0B0D\147D.tmp"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3900
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1472
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3188
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2920
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3200
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:684
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1120
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2328
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1444
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:1864
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1544
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1744
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4720
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3220
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2160
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4992
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3656
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4104
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3944
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2700
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4108
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3984
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1480
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1284
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:2336
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1404
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5036
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3488
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1640
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Modifies registry class
        PID:4108
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3868
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4992
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4492
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3368
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4188
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:1688
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:2184
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:3656
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3348
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:4216
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4240
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3896
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:2460
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:2688
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3984
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:4328
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:4756
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1988
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4248
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3580
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4780
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:3920
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:4220
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3008
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3564
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3200
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:436
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:3720
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:832
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:1400
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:4716
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3692
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:1864

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Execution

                                                                        Persistence

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Active Setup

                                                                        1
                                                                        T1547.014

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Privilege Escalation

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Active Setup

                                                                        1
                                                                        T1547.014

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Defense Evasion

                                                                        Modify Registry

                                                                        5
                                                                        T1112

                                                                        Credential Access

                                                                        Credentials from Password Stores

                                                                        1
                                                                        T1555

                                                                        Credentials from Web Browsers

                                                                        1
                                                                        T1555.003

                                                                        Unsecured Credentials

                                                                        3
                                                                        T1552

                                                                        Credentials In Files

                                                                        3
                                                                        T1552.001

                                                                        Discovery

                                                                        Peripheral Device Discovery

                                                                        2
                                                                        T1120

                                                                        Query Registry

                                                                        4
                                                                        T1012

                                                                        System Information Discovery

                                                                        2
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        Lateral Movement

                                                                        Collection

                                                                        Data from Local System

                                                                        2
                                                                        T1005

                                                                        Command and Control

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Program Files (x86)\LP\0B0D\147D.tmp
                                                                          Filesize

                                                                          98KB

                                                                          MD5

                                                                          be3c3fbcfec757ce744f2ec4c1d29d7b

                                                                          SHA1

                                                                          b837ee4245e00548763e8a32169bfec2db6ea4c9

                                                                          SHA256

                                                                          ea048c587dd9a876e56cc557c3fc4836c0cf0d009e63236242944c3b61cae9fe

                                                                          SHA512

                                                                          64e0edff36037fd452fd3ef2bc3b623080930da5a4e23a6e2a7d548b0fb5f6ff71c129a6b27d10b0622eb50e743d4afd208985058035e6038524c8b461983a06

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                          Filesize

                                                                          471B

                                                                          MD5

                                                                          099cec3daf6c8b40cd9202ac854db03e

                                                                          SHA1

                                                                          9cd799dacdfffd54ec2379b375eedfc233719876

                                                                          SHA256

                                                                          5066c81360e6624f3d818b28173d8861ae4527e542b4b3f17bf426eab079ebf2

                                                                          SHA512

                                                                          b4e742f28d4c0e150a71ffdc2c12172bd8b64d48d019d76fc201d9a6704f09f391c8952b215ce7ec64995a81ca4c06ec8b29d3c9143ced8dcae30b3ae422d667

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                          Filesize

                                                                          412B

                                                                          MD5

                                                                          4177fc76d912a93f031c2d90e9d828b5

                                                                          SHA1

                                                                          f3aca78039e551c8761db289f00311a5162c63f1

                                                                          SHA256

                                                                          5a22f7c7e3b592bcd8ac740b332318aa329e0f91d8c99a6da8d3297c69d06e2b

                                                                          SHA512

                                                                          d00084de8ed0e4e492b43eb45aaec234eb6942dc8d5dba0e9c288dca38f15a7091d0f60d9b9fd535749baeebdded194056d1a3c31d08d290fc60687a437ef934

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          d8d72849890cdca312df598054f498b7

                                                                          SHA1

                                                                          6861bfbb850dd4eb649b4282c8ae640ddf59eecc

                                                                          SHA256

                                                                          f74656969fbd1cf165ad3ba03f4b1332083c5afe8b20034336239adc5e5a4582

                                                                          SHA512

                                                                          d5b845ef7f35701444716181080c96cd5f8a53ab4cd81ce22b6bb775c187900c15784a8d4e914f5d55db0adf5c6400d402441f1379086ace94275674c1dedd0e

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YOZOSN6K\microsoft.windows[1].xml
                                                                          Filesize

                                                                          97B

                                                                          MD5

                                                                          e6ba99d8293b4c7951bad0a2c6761b8e

                                                                          SHA1

                                                                          87aaf2d975cdef4db219e4f9f2b1469dd05a6b0b

                                                                          SHA256

                                                                          773b2b8b752a5bfd3d93b7475dbb7f659bad014ffd06292ee0450c216892ac29

                                                                          SHA512

                                                                          e6861e87688861f4c43d80f9e98996fc476a11d4e147eb3c55f66d6f1abc065690e2662dd34dca32c0284b64056b95142d932697aa1fa6d6b755ef0f57031ee0

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\DCC63\3EBD.CC6
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          7324ad5e4fac60dc80bdfc2f56e5e266

                                                                          SHA1

                                                                          e37c5199f0a8607c9668d46d89448e13d1a5c6a3

                                                                          SHA256

                                                                          5875a3594dae2976ec189cedf199fed10edeafc3660c7278bd4a1336e7dc14c1

                                                                          SHA512

                                                                          76e1c590c2d2648260e4191e040db3d4efe1f3a3cedb30d6f358e4c08a7ccc49a03cc70517f6c402a8aef04d5d6bad9eb6948338cb37d36e0bc590a75ea8e140

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\DCC63\3EBD.CC6
                                                                          Filesize

                                                                          600B

                                                                          MD5

                                                                          3da3ae152dada36ce99455fb283e8df4

                                                                          SHA1

                                                                          208cdcec3eaf06e8701322dda7df49e5c1a9d019

                                                                          SHA256

                                                                          71450bf72078795273991759c1bdcbb32c3bd30489981525a9e71c755bf41b91

                                                                          SHA512

                                                                          f734be606465cb05480c44bdbecb8d3ffd2048da5ba4a8003581fa73d255f0ff1844530606e94d750fe806ca4e7ca5d23d2fee02140fffe1a99cffa144e4d9b6

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\DCC63\3EBD.CC6
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          961996e4453976f1397c840f55943f03

                                                                          SHA1

                                                                          a172f40f76de7c33005a09e0cf7303b9ece0d4d3

                                                                          SHA256

                                                                          272b1b2fa0e9940b10ae2a531fdfdc77f4edb5e2e764f6ef5ee5ffa2991e8414

                                                                          SHA512

                                                                          db546313572fb67bdf49436c8ae88cfecab7b53de9f5c6028a39beebf3e2f4ed0e58939dae4671c2a4c3d1fae71da85c7f7d8deebd1d63c821cf7b04b75b4834

                                                                          Download Submit

                                                                        • memory/1120-206-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/1192-84-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/1444-207-0x000001DAB2160000-0x000001DAB2260000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1444-212-0x000001DAB3190000-0x000001DAB31B0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1444-224-0x000001DAB3150000-0x000001DAB3170000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1444-243-0x000001DAB3560000-0x000001DAB3580000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1688-1219-0x0000000003FA0000-0x0000000003FA1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/1744-367-0x0000022B97520000-0x0000022B97540000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1744-389-0x0000022B97930000-0x0000022B97950000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1744-357-0x0000022B97560000-0x0000022B97580000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/1744-353-0x0000022B96400000-0x0000022B96500000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1744-352-0x0000022B96400000-0x0000022B96500000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/1864-350-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2160-502-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2336-803-0x0000000004580000-0x0000000004581000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2700-656-0x000002505B900000-0x000002505BA00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/2700-673-0x000002505C960000-0x000002505C980000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2700-659-0x000002505C9A0000-0x000002505C9C0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2700-685-0x000002505CD70000-0x000002505CD90000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/2700-654-0x000002505B900000-0x000002505BA00000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/3220-17-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/3220-14-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/3220-15-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/3656-1220-0x0000011D4C800000-0x0000011D4C900000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/3656-506-0x000001D0BCE20000-0x000001D0BCF20000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/3656-504-0x000001D0BCE20000-0x000001D0BCF20000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/3656-509-0x000001D0BDF80000-0x000001D0BDFA0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3656-533-0x000001D0BE350000-0x000001D0BE370000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3656-521-0x000001D0BDF40000-0x000001D0BDF60000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/3900-98-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                          Filesize

                                                                          108KB

                                                                          Download

                                                                        • memory/4104-652-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4108-950-0x0000000004440000-0x0000000004441000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4188-1107-0x0000024118750000-0x0000024118770000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4188-1087-0x0000024118340000-0x0000024118360000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4188-1075-0x0000024118380000-0x00000241183A0000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4188-1070-0x0000024117220000-0x0000024117320000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4188-1072-0x0000024117220000-0x0000024117320000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4264-85-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/4264-499-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/4264-203-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/4264-2-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/4264-3-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                          Download

                                                                        • memory/4264-1-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                          Download

                                                                        • memory/4264-4-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/4264-18-0x0000000000400000-0x0000000000469000-memory.dmp

                                                                          Filesize

                                                                          420KB

                                                                          Download

                                                                        • memory/4492-1068-0x0000000004030000-0x0000000004031000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4992-978-0x0000026B525F0000-0x0000026B52610000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4992-966-0x0000026B51FE0000-0x0000026B52000000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/4992-952-0x0000026B51100000-0x0000026B51200000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/4992-957-0x0000026B52220000-0x0000026B52240000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/5036-809-0x0000027574220000-0x0000027574240000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/5036-804-0x0000027573100000-0x0000027573200000-memory.dmp

                                                                          Filesize

                                                                          1024KB

                                                                          Download

                                                                        • memory/5036-819-0x0000027573FE0000-0x0000027574000000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download

                                                                        • memory/5036-833-0x00000275745F0000-0x0000027574610000-memory.dmp

                                                                          Filesize

                                                                          128KB

                                                                          Download