Overview

overview

10

Static

static

3

JaffaCakes...9f.exe

windows7-x64

10

JaffaCakes...9f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    83s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-01-2025 21:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe

  • Size

    173KB

  • MD5

    975e4eb479cee6e64db95f92ba16b09f

  • SHA1

    454ed006f79e3fcd5c7cbc6990804f577e21f770

  • SHA256

    1d2eb7fcf146e5a44450a0bcabd9d236cab78e3f68b4d835447ccc3d492a9b2d

  • SHA512

    b4c3e0fe8cd2411e0b158bb99933bf1028fceabbde38de1008f9a4fc9534e441ce160bf2081b64f3901b6038ca53974d2358d431373c7b3406ec58b90cdeae1b

  • SSDEEP

    3072:mWaxnaAF8CFG+a8oaLbkTukdxNPvuOffLL9NAt412s0gWzCEwSX7fXyr:/axaU4+aHTuqvuOffLhNAS2s0dCE/LfK

Score
10/10
cycbotbackdoordiscoveryevasionpersistenceratupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4348
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe startC:\Users\Admin\AppData\Roaming\BFEC4\AEBE9.exe%C:\Users\Admin\AppData\Roaming\BFEC4
      2⤵
        PID:4960
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_975e4eb479cee6e64db95f92ba16b09f.exe startC:\Program Files (x86)\C4A20\lvvm.exe%C:\Program Files (x86)\C4A20
        2⤵
          PID:4860
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1160
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4236
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4360
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:472
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2920
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4812
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4412
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3288
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:3772
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4328
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3456
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:3744
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4112
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4812
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4076
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2352
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2476
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2860
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4524
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3736
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:1364
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4976
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3612
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:4516
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:644
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2496
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:3928
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3552
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2188
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        PID:2688
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4924
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3680
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        PID:1944
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1572
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Modifies registry class
        PID:3456
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3952
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1856
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4300
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:1988
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:2444
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:1856
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3452
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4124
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:5116
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1772
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:1812
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:3544
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4088
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4260
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:1812
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:2860
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:2728
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2576
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4924
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:4252
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2564
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:2736
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2484
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:1896
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:2868
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:2976
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:60
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:4724
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:3848
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:3500
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:1916
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:4744
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:3532
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:1600
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:556
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:2352
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                  PID:3796
                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                  1⤵
                                                                                    PID:1432
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:3736
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                        PID:1324
                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                        1⤵
                                                                                          PID:2188

                                                                                        Network

                                                                                        MITRE ATT&CK Enterprise v15

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                          Filesize

                                                                                          471B

                                                                                          MD5

                                                                                          2b8c125024af4be5c310543b8e32ca36

                                                                                          SHA1

                                                                                          3b2ce39da7405dfdfa29f98b3bee3fafc86640e4

                                                                                          SHA256

                                                                                          7b2ce829266fb19ceb231968528dc176e8cb84bcd3f67824b8b106135755d153

                                                                                          SHA512

                                                                                          4b895c2e4cf14f5731d7d48509e83fff3a72dab894ee494353cb70a7597153bbc23b7bbf9d1780117d74708a3f70909b19be2b681773ae16d54e5af78a7dbdb9

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                          Filesize

                                                                                          412B

                                                                                          MD5

                                                                                          fef757117c7eb9ff8f0f03ab2e7f46af

                                                                                          SHA1

                                                                                          ef8ea2297ff13a4153162195d49a30c9162680c4

                                                                                          SHA256

                                                                                          5ca402854707d39990b7b871ca8246607b7d9e53cdca85a709e420857b0f30c9

                                                                                          SHA512

                                                                                          b4f28723dd540ddba51b7021953cd711dac58a8a59016a626db0a8121f7dde0efc64df65219101f64ca9c9ceb9f7c51f66618caceca793452bf567396f307c2f

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                          Filesize

                                                                                          2KB

                                                                                          MD5

                                                                                          7eca743a3a08696056bd3aa3c01bf5ea

                                                                                          SHA1

                                                                                          94f15d722555d5c6afe3bde515b3b0db507a89ae

                                                                                          SHA256

                                                                                          8fa17fe96df3a4a32d91b1e5637a03059b7d6a7f4e0f07b30c7fdb02a6450e8f

                                                                                          SHA512

                                                                                          8aab1877200c346a3cb31132e5493f830d88e0132fa3e1d9ad7d58fe49f38d353cbd1107011d922bf638ea6c95ad1662d38743b71606f8adc620882c2020c146

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\80AM9X7C\microsoft.windows[1].xml
                                                                                          Filesize

                                                                                          96B

                                                                                          MD5

                                                                                          c839a1973d3feaead377ea2dad131fe6

                                                                                          SHA1

                                                                                          252758616792b9b2f10bc460c84b1c1eba75ea04

                                                                                          SHA256

                                                                                          efecd8d483398a6cb569af17e66cb0ba1ca4b9c65f4a697fc7642cc007fc3ccd

                                                                                          SHA512

                                                                                          fee6ca3d2ae272b0f1f291e98830215f2ac138747651be78325ab7c1ba3f01f72cbfed4c886853caba45f16c59c78543a87a5f872b2c1f85bffa3a4e11bf50e1

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\BFEC4\4A20.FEC
                                                                                          Filesize

                                                                                          1KB

                                                                                          MD5

                                                                                          1545e6b739af3fb20c537511292fa782

                                                                                          SHA1

                                                                                          9157d578e972ebc5a5719e1d374193e16deaa4a0

                                                                                          SHA256

                                                                                          9efdaf589b83ed585e65cef6b22d35b5565847ea62ee2be491f2cbacaf939b60

                                                                                          SHA512

                                                                                          c2de54c582b48182edfcc425ad1f876519c50560af97ac724849c2068aaba86a3bace947690af0ec83dae05e0ed48f821510141d95590723f08c75288298dfbd

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\BFEC4\4A20.FEC
                                                                                          Filesize

                                                                                          600B

                                                                                          MD5

                                                                                          2f1dfd51c35758f799ac7c84b011d822

                                                                                          SHA1

                                                                                          c25c102ff68e4310ad3125385cbff23eb7547cb1

                                                                                          SHA256

                                                                                          413ddf98a872e0ed7a7b70dfc84b468bc4815f9f3864aa4cb6bfa774bf0c1296

                                                                                          SHA512

                                                                                          e4435c0a1439ed7f5dd56c1301bbfeb90a404faeab81c96b80df97f15b50c3eee75878ec746d85139ee7d28220fbb5a9e0506f4dcca55caccaa0f73958e9108b

                                                                                          Download Submit

                                                                                        • C:\Users\Admin\AppData\Roaming\BFEC4\4A20.FEC
                                                                                          Filesize

                                                                                          996B

                                                                                          MD5

                                                                                          07015c073b19e37edefa891041656573

                                                                                          SHA1

                                                                                          75a10cefefefd10bfb893ad1ef030300c760f966

                                                                                          SHA256

                                                                                          890824276130ccaa367233a90066b86f67d9947e57650ed5ed5da47411726887

                                                                                          SHA512

                                                                                          4f543dfc500823b4e745666979966abdfecf811847f1c0dbbb4ef40b268f47cd8e9e07d550b3683b55b3c2e25ac0d3526e0b4e66a9aae619908c53d554415ada

                                                                                          Download Submit

                                                                                        • memory/1364-937-0x0000000003F70000-0x0000000003F71000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2188-1243-0x0000014349A00000-0x0000014349A20000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2188-1267-0x0000014349DC0000-0x0000014349DE0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2188-1255-0x00000143497B0000-0x00000143497D0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2476-656-0x000001C3A2920000-0x000001C3A2940000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2476-642-0x000001C3A1800000-0x000001C3A1900000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/2476-674-0x000001C3A2D20000-0x000001C3A2D40000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2476-643-0x000001C3A1800000-0x000001C3A1900000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/2476-647-0x000001C3A2960000-0x000001C3A2980000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2496-1117-0x000001EA4F680000-0x000001EA4F6A0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2496-1092-0x000001EA4E800000-0x000001EA4E900000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/2496-1096-0x000001EA4F6C0000-0x000001EA4F6E0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2496-1128-0x000001EA4FCA0000-0x000001EA4FCC0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/2496-1091-0x000001EA4E800000-0x000001EA4E900000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/2688-1369-0x0000000004920000-0x0000000004921000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/2860-788-0x0000000003FF0000-0x0000000003FF1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/3288-208-0x000002703CF80000-0x000002703CFA0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3288-221-0x000002703D390000-0x000002703D3B0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3288-196-0x000002703CFC0000-0x000002703CFE0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3288-191-0x000002703BFA0000-0x000002703C0A0000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3288-193-0x000002703BFA0000-0x000002703C0A0000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3456-349-0x000001BCD3B90000-0x000001BCD3BB0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3456-371-0x000001BCD3F60000-0x000001BCD3F80000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3456-358-0x000001BCD3B50000-0x000001BCD3B70000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3456-346-0x000001B4D1A40000-0x000001B4D1B40000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3612-976-0x0000021C3CF90000-0x0000021C3CFB0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3612-939-0x0000021C3BB00000-0x0000021C3BC00000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3612-959-0x0000021C3CB80000-0x0000021C3CBA0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3612-944-0x0000021C3CBC0000-0x0000021C3CBE0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3680-1372-0x0000014473840000-0x0000014473940000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3680-1371-0x0000014473840000-0x0000014473940000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3680-1376-0x00000144747A0000-0x00000144747C0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3680-1408-0x0000014474D70000-0x0000014474D90000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3680-1388-0x0000014474760000-0x0000014474780000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3680-1373-0x0000014473840000-0x0000014473940000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3736-805-0x000001BAC5330000-0x000001BAC5350000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3736-817-0x000001BAC5740000-0x000001BAC5760000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3736-790-0x000001BAC4220000-0x000001BAC4320000-memory.dmp

                                                                                          Filesize

                                                                                          1024KB

                                                                                          Download

                                                                                        • memory/3736-795-0x000001BAC5370000-0x000001BAC5390000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/3744-491-0x0000000004540000-0x0000000004541000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/3772-343-0x0000000004440000-0x0000000004441000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/3928-1237-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4076-640-0x0000000004E20000-0x0000000004E21000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4348-1-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                          Filesize

                                                                                          316KB

                                                                                          Download

                                                                                        • memory/4348-2-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4348-17-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4348-16-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                          Filesize

                                                                                          316KB

                                                                                          Download

                                                                                        • memory/4348-1235-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4348-81-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4348-340-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4516-1089-0x0000000002FC0000-0x0000000002FC1000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4812-190-0x0000000003870000-0x0000000003871000-memory.dmp

                                                                                          Filesize

                                                                                          4KB

                                                                                          Download

                                                                                        • memory/4812-498-0x000001CC24F80000-0x000001CC24FA0000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4812-522-0x000001CC25350000-0x000001CC25370000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4812-510-0x000001CC24F40000-0x000001CC24F60000-memory.dmp

                                                                                          Filesize

                                                                                          128KB

                                                                                          Download

                                                                                        • memory/4860-80-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4960-12-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4960-13-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download

                                                                                        • memory/4960-15-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                          Filesize

                                                                                          328KB

                                                                                          Download