Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8a9a573b71...70.exe

windows7-x64

10

8a9a573b71...70.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/01/2025, 12:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70.exe

  • Size

    278KB

  • MD5

    dd223d2538c382b6728463175ad0d68c

  • SHA1

    737eea7628ec4c2c2da8c5890376652778024f64

  • SHA256

    8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70

  • SHA512

    2ad6a30a7f1cb428a5d87c478247322c66dc9f39cab9bbd7fe76db3de4afbe5173d0f6c115162c45138db754f18a9337a140c99bee587ebdf49620d514ec636b

  • SSDEEP

    6144:lgRqbGn6NH+qcEDlCC/R4eilAZ88K8snV7mv+Juoq:l+qbGceGlD/yeLZV4A2JuN

Score
10/10
cycbotponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70.exe
    "C:\Users\Admin\AppData\Local\Temp\8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70.exe
      C:\Users\Admin\AppData\Local\Temp\8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70.exe startC:\Users\Admin\AppData\Roaming\D7158\B38F9.exe%C:\Users\Admin\AppData\Roaming\D7158
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1164
    • C:\Users\Admin\AppData\Local\Temp\8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70.exe
      C:\Users\Admin\AppData\Local\Temp\8a9a573b71f064e65e33b26bd5ef541eff9ac5e5b8f516c469ca4944e636fe70.exe startC:\Program Files (x86)\58D47\lvvm.exe%C:\Program Files (x86)\58D47
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1672
    • C:\Program Files (x86)\LP\F9DD\3F85.tmp
      "C:\Program Files (x86)\LP\F9DD\3F85.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3324
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2176
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3972
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1280
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2540
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4016
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4092
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:908
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2052
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1172
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:5072
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1332
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3676
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4856
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1820
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2300
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4384
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2644
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    PID:2064
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3424
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4076
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:4364
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2120
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:928
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1280
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2088
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:1988
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3756
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3356
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4212
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4224
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:5088
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2968
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:448
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4008
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4504
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3648
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:1612
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4984
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2300
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:2644
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3440
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:1732
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:244
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1924
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:5012
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:3188
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4364
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:1900
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4540
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4528
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:2904
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:3012
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                        1⤵
                                                                          PID:3988
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:2884
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                              PID:5064
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                              1⤵
                                                                                PID:1476
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:3756

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Active Setup

                                                                                1
                                                                                T1547.014

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Active Setup

                                                                                1
                                                                                T1547.014

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Defense Evasion

                                                                                Modify Registry

                                                                                5
                                                                                T1112

                                                                                Credential Access

                                                                                Credentials from Password Stores

                                                                                1
                                                                                T1555

                                                                                Credentials from Web Browsers

                                                                                1
                                                                                T1555.003

                                                                                Unsecured Credentials

                                                                                3
                                                                                T1552

                                                                                Credentials In Files

                                                                                3
                                                                                T1552.001

                                                                                Discovery

                                                                                Peripheral Device Discovery

                                                                                2
                                                                                T1120

                                                                                Query Registry

                                                                                4
                                                                                T1012

                                                                                System Information Discovery

                                                                                2
                                                                                T1082

                                                                                System Location Discovery

                                                                                1
                                                                                T1614

                                                                                System Language Discovery

                                                                                1
                                                                                T1614.001

                                                                                Lateral Movement

                                                                                Collection

                                                                                Data from Local System

                                                                                2
                                                                                T1005

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Program Files (x86)\LP\F9DD\3F85.tmp
                                                                                  Filesize

                                                                                  99KB

                                                                                  MD5

                                                                                  55ce0a78d2d9f3b77a707191cbb289cc

                                                                                  SHA1

                                                                                  a45bfce1c2de0de0f3222f9e388a1d19a84c0c07

                                                                                  SHA256

                                                                                  1cd3bf36ce50f03435f912f72092a561a9106f92f1a94b6028db3012960c5c2a

                                                                                  SHA512

                                                                                  50727fd305ef36f6dc28a8a1a7f12df2e82e024a89be0d51e79e034c8de99fbf3a0c71b5578a0c1171296724e7c39121443d2568b62edc4ef5a75da626e7b319

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                  Filesize

                                                                                  471B

                                                                                  MD5

                                                                                  099cec3daf6c8b40cd9202ac854db03e

                                                                                  SHA1

                                                                                  9cd799dacdfffd54ec2379b375eedfc233719876

                                                                                  SHA256

                                                                                  5066c81360e6624f3d818b28173d8861ae4527e542b4b3f17bf426eab079ebf2

                                                                                  SHA512

                                                                                  b4e742f28d4c0e150a71ffdc2c12172bd8b64d48d019d76fc201d9a6704f09f391c8952b215ce7ec64995a81ca4c06ec8b29d3c9143ced8dcae30b3ae422d667

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                  Filesize

                                                                                  412B

                                                                                  MD5

                                                                                  cc935aefd182442c75928cd9e9c1df23

                                                                                  SHA1

                                                                                  fd4d6392e58ddc10fd923c744283994be4ee24ae

                                                                                  SHA256

                                                                                  bdf38e9366fcb804c757cfbe9a3b9a8300e1358323fde9a0e448fc6bca26af32

                                                                                  SHA512

                                                                                  bef4873e50f57f52500573116501ba06c6702480eb8133d6855460359a3adf324737be00dcc008650c9583f44a8872e89bd642be5790af45054ce5f6238405ca

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  f4374c2bfded4cf3c75731ea1250433e

                                                                                  SHA1

                                                                                  25547147c79e13425de3a31982e7e7d16bd697c6

                                                                                  SHA256

                                                                                  095c97b39a50670486b9464e91804dd9eb73bfe77b222d7457d4c807fae1593d

                                                                                  SHA512

                                                                                  1454e3d0987bca68da9510f1d7a559d4acbc253a3f2e00ee3a002197de79fe189cb7e6b44abf0f5b75ca5d155e5d2325aad197590cd84330298b657daa7d0233

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80GI1ZH7\microsoft.windows[1].xml
                                                                                  Filesize

                                                                                  97B

                                                                                  MD5

                                                                                  742f1cda58883699ef753f83244412ce

                                                                                  SHA1

                                                                                  38531f396e1d9dc9ba6bba0604149c377605f57a

                                                                                  SHA256

                                                                                  5ef67927e9fdebb14515728d51548c52536519b35b5a52728ca1d660d957025f

                                                                                  SHA512

                                                                                  11acf77cd15052ae9cf554ab666f6c1e629e174fad16659738a11bee6a53b857f375fe99701e7c14c14286193864449f5b88a208ff34f4874e8351dff6a3a6f2

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\D7158\8D47.715
                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  15c139224f0cb8dd8b942b7b5617f726

                                                                                  SHA1

                                                                                  38c6d6c8e09443b05f18a1e735af3c147304ee49

                                                                                  SHA256

                                                                                  33e1a8a3cc35763746de21dd7a7b775baa651264694540de0c669c0942c7e590

                                                                                  SHA512

                                                                                  ab142d0e5ae9632ae277e6a45eff46b8263578958bc6bc3ca7636dbbfd8c94630f557a80c759aaba5b78edbf948a6b46f33aba221538200987a9e84c74616e74

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\D7158\8D47.715
                                                                                  Filesize

                                                                                  600B

                                                                                  MD5

                                                                                  6da9ebab360b47f9cbe1c2d440729950

                                                                                  SHA1

                                                                                  181e9020bfe1f263b7d074f8747696f2258ee624

                                                                                  SHA256

                                                                                  8d1964cd5a3908f50bda33b5b82775f8cc5ebd86fc6c999f539ac17299550421

                                                                                  SHA512

                                                                                  86cf5addd22be4184f7530751d397837d8448126f783477b734efa7724a1b613f28be406b99a06de140562be5d18c819e0b9f70bd00dfac773c4b41c69558f8b

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Roaming\D7158\8D47.715
                                                                                  Filesize

                                                                                  996B

                                                                                  MD5

                                                                                  e91b861c7caf9f032b73607a377a56a7

                                                                                  SHA1

                                                                                  505003b70d1fb5991a96d870ccb9eaa9ea22ed4c

                                                                                  SHA256

                                                                                  22b5eefe85a22a152cb002cc8df7d6f0953463209976fb612c4fbc8db3cd8a51

                                                                                  SHA512

                                                                                  3957882a01176fc116ed51755550554ab8ba9c56e2c67389c42ddbb8fb97e87766d10258ed5440f0a25b428bef5cd5b1c395a0012d8a7d91ef77cde14ab5b418

                                                                                  Download Submit

                                                                                • memory/908-331-0x0000000003860000-0x0000000003861000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/928-1087-0x00000275F78D0000-0x00000275F78F0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/928-1082-0x0000026DF5770000-0x0000026DF5870000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/928-1119-0x00000275F7CA0000-0x00000275F7CC0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/928-1095-0x00000275F7890000-0x00000275F78B0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1164-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                  Filesize

                                                                                  428KB

                                                                                  Download

                                                                                • memory/1164-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                  Filesize

                                                                                  428KB

                                                                                  Download

                                                                                • memory/1172-350-0x000002A2AE800000-0x000002A2AE820000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1172-361-0x000002A2AEC00000-0x000002A2AEC20000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1172-335-0x000002A2AD700000-0x000002A2AD800000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1172-333-0x000002A2AD700000-0x000002A2AD800000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1172-338-0x000002A2AE840000-0x000002A2AE860000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1280-1230-0x00000000049D0000-0x00000000049D1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1672-73-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                  Filesize

                                                                                  428KB

                                                                                  Download

                                                                                • memory/1820-656-0x0000027AF0300000-0x0000027AF0320000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1820-646-0x0000027AF0340000-0x0000027AF0360000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1820-669-0x0000027AF0710000-0x0000027AF0730000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1988-1234-0x000001BE9F120000-0x000001BE9F220000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1988-1246-0x000001BEA0230000-0x000001BEA0250000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1988-1257-0x000001BEA0640000-0x000001BEA0660000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1988-1237-0x000001BEA0270000-0x000001BEA0290000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1988-1232-0x000001BE9F120000-0x000001BE9F220000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/1988-1233-0x000001BE9F120000-0x000001BE9F220000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/2064-930-0x00000000040C0000-0x00000000040C1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2284-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                  Filesize

                                                                                  416KB

                                                                                  Download

                                                                                • memory/2284-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                                                                  Filesize

                                                                                  416KB

                                                                                  Download

                                                                                • memory/2284-71-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                  Filesize

                                                                                  428KB

                                                                                  Download

                                                                                • memory/2284-632-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                  Filesize

                                                                                  428KB

                                                                                  Download

                                                                                • memory/2284-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                  Filesize

                                                                                  428KB

                                                                                  Download

                                                                                • memory/2284-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                  Filesize

                                                                                  428KB

                                                                                  Download

                                                                                • memory/2300-784-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2540-176-0x0000000002960000-0x0000000002961000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2644-787-0x000002667C400000-0x000002667C500000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/2644-786-0x000002667C400000-0x000002667C500000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/2644-791-0x000002667D2F0000-0x000002667D310000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2644-788-0x000002667C400000-0x000002667C500000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/2644-801-0x000002667D2B0000-0x000002667D2D0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2644-823-0x000002667D8C0000-0x000002667D8E0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3324-608-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                  Filesize

                                                                                  112KB

                                                                                  Download

                                                                                • memory/3624-530-0x0000023A5A920000-0x0000023A5A940000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3624-493-0x0000023A59400000-0x0000023A59500000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/3624-498-0x0000023A5A560000-0x0000023A5A580000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3624-507-0x0000023A5A520000-0x0000023A5A540000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3624-494-0x0000023A59400000-0x0000023A59500000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/3624-495-0x0000023A59400000-0x0000023A59500000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/3676-640-0x00000000041B0000-0x00000000041B1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3756-1383-0x0000000004C50000-0x0000000004C51000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4076-937-0x000002FDBD580000-0x000002FDBD5A0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4076-949-0x000002FDBD540000-0x000002FDBD560000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4076-961-0x000002FDBD950000-0x000002FDBD970000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4076-932-0x000002FDBC420000-0x000002FDBC520000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4092-213-0x000002303AB00000-0x000002303AB20000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4092-193-0x000002303A500000-0x000002303A520000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4092-182-0x000002303A540000-0x000002303A560000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4092-177-0x0000023039720000-0x0000023039820000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4212-1385-0x000001CCE1420000-0x000001CCE1520000-memory.dmp

                                                                                  Filesize

                                                                                  1024KB

                                                                                  Download

                                                                                • memory/4364-1080-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/5072-491-0x0000000004260000-0x0000000004261000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download