Overview

overview

10

Static

static

3

JaffaCakes...bf.exe

windows7-x64

10

JaffaCakes...bf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2025 23:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_11fa3d2a79204be85855d65b269533bf.exe

  • Size

    314KB

  • MD5

    11fa3d2a79204be85855d65b269533bf

  • SHA1

    4b0d0e9f31cab8d907dd9f0f88e6d5235badbef4

  • SHA256

    77d59c32ed5adbfdc7ced9dd6438bd787af7ad69ac6e6ba53726893d7cdf0a80

  • SHA512

    6e1d3cd65857bb31528b2d8961320b86479e6b02eb633c23ac2ef86add295aa780dbd7cbd5d8ec9375d6d797f3a280f7b012d1a4d97f714a1d2915c2ca8cd90f

  • SSDEEP

    6144:z/L3iwgsfDSMj41UKL6dkONAAFPocl1m0wn83OFLOwLOu:z/ngsrSMkJLtSNFgcl1m0w8+x

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 7 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11fa3d2a79204be85855d65b269533bf.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11fa3d2a79204be85855d65b269533bf.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:692
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11fa3d2a79204be85855d65b269533bf.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11fa3d2a79204be85855d65b269533bf.exe startC:\Users\Admin\AppData\Roaming\7C0F8\F0D14.exe%C:\Users\Admin\AppData\Roaming\7C0F8
      2⤵
      • System Location Discovery: System Language Discovery
      PID:668
    • C:\Program Files (x86)\LP\14E7\34F6.tmp
      "C:\Program Files (x86)\LP\14E7\34F6.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3380
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11fa3d2a79204be85855d65b269533bf.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11fa3d2a79204be85855d65b269533bf.exe startC:\Program Files (x86)\F8E47\lvvm.exe%C:\Program Files (x86)\F8E47
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4184
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4384
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1736
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2480
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3472
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4956
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4700
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    PID:4648
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2712
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2684
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3116
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2340
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2968
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3468
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3988
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4832
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:912
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3132
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:3468
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3444
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1248
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4864
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1596
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3960
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2268
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:64
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1460
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:804
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3956
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3896
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:3304
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:212
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:2808
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:836
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3960
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4924
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3304
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4332
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:4704
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4544
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:1376
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4160
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:4672
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:668
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:3580
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:936
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:4180
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4544
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2712
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3716
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:768
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2152
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3812
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:4200
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4076
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:1388
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:4992
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:960

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Windows Service

                                                      1
                                                      T1543.003

                                                      Defense Evasion

                                                      Modify Registry

                                                      5
                                                      T1112

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      3
                                                      T1552

                                                      Credentials In Files

                                                      3
                                                      T1552.001

                                                      Discovery

                                                      Peripheral Device Discovery

                                                      2
                                                      T1120

                                                      Query Registry

                                                      4
                                                      T1012

                                                      System Information Discovery

                                                      2
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Lateral Movement

                                                      Collection

                                                      Data from Local System

                                                      2
                                                      T1005

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Program Files (x86)\LP\14E7\34F6.tmp
                                                        Filesize

                                                        107KB

                                                        MD5

                                                        ebec172b21c1a8032a34cbaee1517f52

                                                        SHA1

                                                        a34b5c4cded0d80e9ced4fb9b33ecb142060de55

                                                        SHA256

                                                        4972245901de570e2f6db848ac371d3aa85676596698611f2349758cd9765353

                                                        SHA512

                                                        e8517f20a836d95815e4d4fe7100cc9ae8cc13e8ab23f7b3f44525742b9552aff5a24948c05ff95cf232c854bd05756271211685583a9e01451d12e256951ff9

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                        Filesize

                                                        471B

                                                        MD5

                                                        f9128bb8d29036190effdd498b081442

                                                        SHA1

                                                        639c03179c72c8ece261f2c30267cd35149dc71a

                                                        SHA256

                                                        1b0d02ad59cfd790431bbed74cafb68aee2ca8918e6d00d1282c208ba327c4aa

                                                        SHA512

                                                        81378f6720867ec67ee5d4f5120b16327d8e707ec908b890bcddd2319b3abc35848098f828f8e5db4028f997ffa17ab764608e61a9acaacbb837a92e9587ec8b

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                        Filesize

                                                        412B

                                                        MD5

                                                        dce0452d232d213234c07c10d839ca4e

                                                        SHA1

                                                        6f7360dfdf11637bac6e2aa7c13e723f313c265e

                                                        SHA256

                                                        3a56f18c79f34cd683d25f763fc28cfd58669e7006e1f3de607e32c016c89a37

                                                        SHA512

                                                        f63251de57831b171689cf20017265a57079b92c33222f658d663daacd78fa87ffc07df732d658b051aea98d99af9737ec7a6b4ccdb72e3ed14817f430dfa7c8

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        df2e883053bbecf9b2f7253cd2b0baea

                                                        SHA1

                                                        93ba9f09e37d3a76975709972857fa4f97f14759

                                                        SHA256

                                                        d9eb4ec1302418d1661502371aae3a0ec0d4f28de7af608a4dd985b1c87f0ad8

                                                        SHA512

                                                        8e7ff47b519d85fb694f128e3b144af94d5d29bc8e1ad59c0519d22003b3bec009470987a0f0e1a2d9814bc597c7d5c71c5015b8f742f6cf2e0fa0f77b2b5762

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LLDJA3WI\microsoft.windows[1].xml
                                                        Filesize

                                                        97B

                                                        MD5

                                                        372706547a804b876522fe741dbfc040

                                                        SHA1

                                                        9bca733d6804f24c6841ef02b52e8ade1b45d7e4

                                                        SHA256

                                                        09fe1eb66c953d75dc66ff6df9237cde5f419fb25fab6327de9cde6676219651

                                                        SHA512

                                                        cc8057de048bf5646e41bed6f01111328bceae9abb4282a4ee1be635d086b6b3647cb5cc17cc3564980e5e31342a767dc639e536edbd3720df6b35ac7ebce34a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\7C0F8\8E47.C0F
                                                        Filesize

                                                        600B

                                                        MD5

                                                        9affabe45d5875a7aa8b06063d7d352b

                                                        SHA1

                                                        889ce1ffe8ca68d49851b81e744268086e7d8f0e

                                                        SHA256

                                                        0fcd913fbbc733b1b6fcbacda721458c4b65119cc6f4ceb082607a68df3a7731

                                                        SHA512

                                                        33cd1bc7755f61265d007ef81d4fe57ecd3a75f17ba778174a4b612999850b3b3baa0f375a612755e2ac4784ecfc48df9fd6a0a4d04aa202ca145c03c3d127ea

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\7C0F8\8E47.C0F
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        116e999d4a8d86fa601bc994c9b1afea

                                                        SHA1

                                                        b68e1d66ff4b139ca1a6bd6562e91d210da61dcf

                                                        SHA256

                                                        eb212f7174d3dfce616f8c0c27ec8baa8afe2bf7e09bc8f75ec136614bb0b750

                                                        SHA512

                                                        8aaecaba2167a7f85e51b6184c8889bc56a026f3245ca0adb42d4b496b42b2f79a657b4cde8f1ab07b9fdf3132dcbebc471894436e98db5d9fc43f3abfee0405

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\7C0F8\8E47.C0F
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        ee3a56ba00a80ecae1803353322799c7

                                                        SHA1

                                                        5fff95e868fff780de8e72612314959952dda77b

                                                        SHA256

                                                        2a7c1b4415235ee25795f843fd51cda40cb0bbc0abfc8b5a874faaf76956c46d

                                                        SHA512

                                                        4f99f8941e0fc445563c21bb59c271e0d6d1ab88be3a1036794902fc12dc4c207788b293a2366b0a86dd52538f6acaa5f3bbbf69a6b48d8891348df914a98143

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\7C0F8\8E47.C0F
                                                        Filesize

                                                        897B

                                                        MD5

                                                        ba3c6b2bf18bae8e96957467c27da51e

                                                        SHA1

                                                        fa51fba094ccb11193e6848c288f169d72a977b8

                                                        SHA256

                                                        bed539e37de34d213e614804f75ae57fa4757d0bc57780b859eb77ff0b9b6cff

                                                        SHA512

                                                        287b35215c4dc97cffb3dee576266292ceb1d4616869bdb64ba0521d0c3035c9e7bc32cf492e07759b300f8ee4e74a4e10838dffd40d73ef060f41f748aecfba

                                                        Download Submit

                                                      • memory/64-992-0x0000000003760000-0x0000000003761000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/212-1271-0x0000000004350000-0x0000000004351000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/668-76-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/692-80-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/692-5-0x0000000000400000-0x0000000000469000-memory.dmp

                                                        Filesize

                                                        420KB

                                                        Download

                                                      • memory/692-609-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/692-2-0x0000000000400000-0x0000000000469000-memory.dmp

                                                        Filesize

                                                        420KB

                                                        Download

                                                      • memory/692-3-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/692-202-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/692-0-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/692-4-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/804-994-0x00000190D9C00000-0x00000190D9D00000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/804-999-0x00000190DAAF0000-0x00000190DAB10000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/804-996-0x00000190D9C00000-0x00000190D9D00000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/804-1023-0x00000190DB0C0000-0x00000190DB0E0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/804-1012-0x00000190DAAB0000-0x00000190DAAD0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/836-1310-0x0000012A3DE70000-0x0000012A3DE90000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/836-1279-0x0000012A3DAA0000-0x0000012A3DAC0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/836-1287-0x0000012A3DA60000-0x0000012A3DA80000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/912-612-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1596-870-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2268-886-0x000001FFEE470000-0x000001FFEE490000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/2268-872-0x000001FFED350000-0x000001FFED450000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/2268-897-0x000001FFEE880000-0x000001FFEE8A0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/2268-877-0x000001FFEE4B0000-0x000001FFEE4D0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/2340-462-0x00000000033E0000-0x00000000033E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2712-212-0x000001EA260E0000-0x000001EA26100000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/2712-207-0x000001EA25100000-0x000001EA25200000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/2712-242-0x000001EA264B0000-0x000001EA264D0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/2712-235-0x000001EA260A0000-0x000001EA260C0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/2712-208-0x000001EA25100000-0x000001EA25200000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/3304-1155-0x0000020E31490000-0x0000020E314B0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3304-1143-0x0000020E314D0000-0x0000020E314F0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3304-1175-0x0000020E31AA0000-0x0000020E31AC0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3304-1425-0x0000024A7D020000-0x0000024A7D120000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/3380-203-0x0000000000400000-0x000000000041D000-memory.dmp

                                                        Filesize

                                                        116KB

                                                        Download

                                                      • memory/3444-756-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3468-469-0x0000018F03520000-0x0000018F03540000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3468-481-0x0000018F031D0000-0x0000018F031F0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3468-501-0x0000018F038E0000-0x0000018F03900000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3468-615-0x000001E2D0F00000-0x000001E2D1000000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/3468-614-0x000001E2D0F00000-0x000001E2D1000000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/3468-619-0x000001E2D2040000-0x000001E2D2060000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3468-633-0x000001E2D2000000-0x000001E2D2020000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3468-646-0x000001E2D2410000-0x000001E2D2430000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3956-1137-0x00000000029E0000-0x00000000029E1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3960-1423-0x0000000004800000-0x0000000004801000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4184-200-0x0000000000400000-0x000000000046C000-memory.dmp

                                                        Filesize

                                                        432KB

                                                        Download

                                                      • memory/4700-205-0x0000000004560000-0x0000000004561000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4864-786-0x000002170A6C0000-0x000002170A6E0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4864-758-0x0000021709200000-0x0000021709300000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/4864-763-0x000002170A300000-0x000002170A320000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4864-759-0x0000021709200000-0x0000021709300000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/4864-774-0x0000021709FB0000-0x0000021709FD0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download