Overview

overview

10

Static

static

3

JaffaCakes...8c.exe

windows7-x64

10

JaffaCakes...8c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    72s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2025 17:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_1972a0f1cba10cb14335f7dad0c3e28c.exe

  • Size

    270KB

  • MD5

    1972a0f1cba10cb14335f7dad0c3e28c

  • SHA1

    0c088d49346b741d1fc659fd7c663d549cc0b452

  • SHA256

    0d0bee9879e7bf0219de12201b9401c2582df88fed0bbebd86ecc4f930c6636e

  • SHA512

    e1596e8671c4029eba289ef2ba71a87125b3ed6a13c4a5b59d4bc336e3f414ed2d80e0f8af29dc212bd5ff4fea4bc1a4d14c1bf3c6f59c045acfc3969e623ddf

  • SSDEEP

    6144:a1r3EykWU+WNLtZa2XNQCZ3x2jRDXe6qzif0froq:UrUyw+u7a2XpB2dTVqziao

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 6 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1972a0f1cba10cb14335f7dad0c3e28c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1972a0f1cba10cb14335f7dad0c3e28c.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1972a0f1cba10cb14335f7dad0c3e28c.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1972a0f1cba10cb14335f7dad0c3e28c.exe startC:\Users\Admin\AppData\Roaming\6C829\6BE9E.exe%C:\Users\Admin\AppData\Roaming\6C829
      2⤵
      • System Location Discovery: System Language Discovery
      PID:784
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1972a0f1cba10cb14335f7dad0c3e28c.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1972a0f1cba10cb14335f7dad0c3e28c.exe startC:\Program Files (x86)\29F9C\lvvm.exe%C:\Program Files (x86)\29F9C
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4720
    • C:\Program Files (x86)\LP\9E96\1F89.tmp
      "C:\Program Files (x86)\LP\9E96\1F89.tmp"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2604
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:208
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2128
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3956
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:60
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3136
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3628
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:3816
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5072
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4136
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2516
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1528
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:344
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1868
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3236
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2968
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1884
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3660
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3344
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1092
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3192
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2252
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:2292
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1552
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:4604
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3248
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4136
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3776
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4876
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4776
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5036
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3208
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4048
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4600
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:2936
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:344
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2888
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1012
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1812
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3504
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:3796
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:3232
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:344
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4116
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:1164
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4600
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:2332
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:4644
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:4704
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:2916
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4068
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:2144

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Active Setup

                                      1
                                      T1547.014

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Create or Modify System Process

                                      1
                                      T1543

                                      Windows Service

                                      1
                                      T1543.003

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Active Setup

                                      1
                                      T1547.014

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Create or Modify System Process

                                      1
                                      T1543

                                      Windows Service

                                      1
                                      T1543.003

                                      Defense Evasion

                                      Modify Registry

                                      5
                                      T1112

                                      Credential Access

                                      Credentials from Password Stores

                                      1
                                      T1555

                                      Credentials from Web Browsers

                                      1
                                      T1555.003

                                      Unsecured Credentials

                                      3
                                      T1552

                                      Credentials In Files

                                      3
                                      T1552.001

                                      Discovery

                                      Peripheral Device Discovery

                                      2
                                      T1120

                                      Query Registry

                                      4
                                      T1012

                                      System Information Discovery

                                      2
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      Lateral Movement

                                      Collection

                                      Data from Local System

                                      2
                                      T1005

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files (x86)\LP\9E96\1F89.tmp
                                        Filesize

                                        96KB

                                        MD5

                                        2b1fb0d9666b92e0cce43e75dcb92c59

                                        SHA1

                                        7b239a3858b6ea3d1a0813280bbdddc2072a7938

                                        SHA256

                                        d6b7b1532090214fc5a7d7346ba844635a6b581c760ac045c9a712fdf06cd66b

                                        SHA512

                                        927fd2105b63387c0c16ca3b608e3a9a120d5ba8605fc0556535b580536d0d33acd3b0c914d157af57974438d4b06d0945cfdcd92859de24bbd3348186b99087

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                        Filesize

                                        471B

                                        MD5

                                        f9128bb8d29036190effdd498b081442

                                        SHA1

                                        639c03179c72c8ece261f2c30267cd35149dc71a

                                        SHA256

                                        1b0d02ad59cfd790431bbed74cafb68aee2ca8918e6d00d1282c208ba327c4aa

                                        SHA512

                                        81378f6720867ec67ee5d4f5120b16327d8e707ec908b890bcddd2319b3abc35848098f828f8e5db4028f997ffa17ab764608e61a9acaacbb837a92e9587ec8b

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                        Filesize

                                        412B

                                        MD5

                                        449217475b3d6ce7982bc2b746f74284

                                        SHA1

                                        e9ecdfce089cea1c64e3480a743181cf75650753

                                        SHA256

                                        44b9abfef5abbbe9dbef3b87e365f3a6ec177ad1ba6b2f57d4503141f08069a3

                                        SHA512

                                        3f2e1c1f779989818e47e360f1f9e075da32cfe129d2bfebdbba7e780487d40fd40ba2fcae33886035011227427e8580cb28d4beea48814ae9904ef9d40361b1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                        Filesize

                                        2KB

                                        MD5

                                        a80d58ee56d7c7f5b1da378079bafb94

                                        SHA1

                                        5f92d5c3274fe31ee7782e6d9f47ff6904737df4

                                        SHA256

                                        52bea02cffbf0310a5d71c2bda2fb49a26e4abbe32e7413c068ee71354b52c07

                                        SHA512

                                        291fb5cc39f4f06307acc4959c32a122655a3ca4b4b2a549ff3293f8dfb913494acb1c1765a9c2f005c21ae42b83d10279509ff16e96ca6055450810ad263dc1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133821264992359507.txt
                                        Filesize

                                        75KB

                                        MD5

                                        8bc02a41a1ed70a23d7a38766fddeda1

                                        SHA1

                                        53549d31fad794b7982f622f8e68bd935ebb081c

                                        SHA256

                                        338dc21fedee3115d7ffc4dbdda7d0f7423f9bf20cdb395fdc4e66a89016ac7d

                                        SHA512

                                        c4dd3121483e4f975501d694b2dec8e341c5f0c29f2a445948118e24173337d0c4f7b3930c7455d7b5551900ed957feb2fe592be1a326cf4b90bd219b1bb7eb2

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YCLWQ4BV\microsoft.windows[1].xml
                                        Filesize

                                        97B

                                        MD5

                                        781c2d6d1f6f2f8ae243c569925a6c44

                                        SHA1

                                        6d5d26acc2002f5a507bd517051095a97501931b

                                        SHA256

                                        70687e419879f006d0c50c08657c66b1187b94ea216cfe0a2e6be8bd2de77bc8

                                        SHA512

                                        3599fa8f2ffe140a8f68ec735810d24a5b367a9a551d620baa6dc611ca755dce1a662bf22b90f842d499d2c9530fb8acd634d1654d5e2c1b319574cbf35eadf7

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\6C829\9F9C.C82
                                        Filesize

                                        600B

                                        MD5

                                        36d8d758295f2a038cf9486999f58970

                                        SHA1

                                        3b884993d4d1c63e76080dc913699a727c62a6e8

                                        SHA256

                                        af9c42ce780dee584d0f1a17013d7a84f1376bcb75f9a80b10ec5a1d2f4e72f7

                                        SHA512

                                        19e234053c6e9530011cee9cd2beca29af6673191974f6cd63d280b24e7ec34d9abc189c0023313ce8ab02c907626fdd3972fd16d606f50e875014f063ae04ac

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\6C829\9F9C.C82
                                        Filesize

                                        1KB

                                        MD5

                                        030ed29f0609a348f6090e85bb37e23c

                                        SHA1

                                        8f5e13e1bd38f56e37ccf16a259103817771d638

                                        SHA256

                                        b5fc565bd36fb03fd15eac6874430c9919e87e047259702864dc1aab48119e5a

                                        SHA512

                                        c7d1b84e8d70c45af4201e74f467d31081075025db575f4d14507fca7c608db01f694a67e8e644691b02e51ed96ba104ca931d41d5c1cf790a84a61137e3940f

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\6C829\9F9C.C82
                                        Filesize

                                        996B

                                        MD5

                                        56b5e0840f4b338b5493a187c7ee6bcc

                                        SHA1

                                        8fdaf994b5c11784c9d6a1fc7af4cee408c418f4

                                        SHA256

                                        81381dfe38a2cbe1d554d339a29274c5f5c23d4a701a35932743fc54b9f3876c

                                        SHA512

                                        8dca171555b406a9588d870e4e3da2e313ae543a979e23896eacd7b7b4dc27b90b8479fcca097b1240bef65034e6c32c3c1ae32c86d257390e7ff6a8bd331e03

                                        Download Submit

                                      • memory/60-179-0x0000000003390000-0x0000000003391000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/344-523-0x00000234BC7B0000-0x00000234BC7D0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/344-487-0x00000234BB300000-0x00000234BB400000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/344-488-0x00000234BB300000-0x00000234BB400000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/344-492-0x00000234BC3E0000-0x00000234BC400000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/344-506-0x00000234BC3A0000-0x00000234BC3C0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/784-14-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                        Download

                                      • memory/784-15-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                        Download

                                      • memory/1092-923-0x00000000046B0000-0x00000000046B1000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1868-637-0x0000000004E10000-0x0000000004E11000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1884-780-0x0000000004610000-0x0000000004611000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/2236-630-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                        Download

                                      • memory/2236-1-0x0000000000400000-0x0000000000468000-memory.dmp

                                        Filesize

                                        416KB

                                        Download

                                      • memory/2236-11-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                        Download

                                      • memory/2236-71-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                        Download

                                      • memory/2236-13-0x0000000000400000-0x0000000000468000-memory.dmp

                                        Filesize

                                        416KB

                                        Download

                                      • memory/2236-2-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                        Download

                                      • memory/2252-943-0x000001B6854A0000-0x000001B6854C0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/2252-925-0x000001B684500000-0x000001B684600000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/2252-926-0x000001B684500000-0x000001B684600000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/2252-954-0x000001B685AC0000-0x000001B685AE0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/2252-930-0x000001B6854E0000-0x000001B685500000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/2252-927-0x000001B684500000-0x000001B684600000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/2292-1068-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/2516-485-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/2604-603-0x0000000000400000-0x000000000041B000-memory.dmp

                                        Filesize

                                        108KB

                                        Download

                                      • memory/2968-641-0x00000196ACD40000-0x00000196ACE40000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/2968-676-0x00000196AE260000-0x00000196AE280000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/2968-639-0x00000196ACD40000-0x00000196ACE40000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/2968-644-0x00000196ADE90000-0x00000196ADEB0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/2968-655-0x00000196ADE50000-0x00000196ADE70000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3248-1218-0x0000000004570000-0x0000000004571000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3344-795-0x0000019D30DA0000-0x0000019D30DC0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3344-786-0x0000019D30DE0000-0x0000019D30E00000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3344-805-0x0000019D313B0000-0x0000019D313D0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3628-186-0x000002827B760000-0x000002827B780000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3628-181-0x0000027A79740000-0x0000027A79840000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/3628-182-0x0000027A79740000-0x0000027A79840000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/3628-213-0x000002827BB20000-0x000002827BB40000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3628-197-0x000002827B720000-0x000002827B740000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3776-1219-0x000001BA73600000-0x000001BA73700000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/3776-1232-0x000001BA744D0000-0x000001BA744F0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3776-1245-0x000001BA74AE0000-0x000001BA74B00000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3776-1224-0x000001BA74510000-0x000001BA74530000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/3776-1220-0x000001BA73600000-0x000001BA73700000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/3816-322-0x0000000002280000-0x0000000002281000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/4136-341-0x0000026CDB250000-0x0000026CDB270000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4136-324-0x0000026CDA340000-0x0000026CDA440000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/4136-329-0x0000026CDB290000-0x0000026CDB2B0000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4136-352-0x0000026CDB860000-0x0000026CDB880000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4136-325-0x0000026CDA340000-0x0000026CDA440000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/4604-1072-0x000002D2B9200000-0x000002D2B9300000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/4604-1070-0x000002D2B9200000-0x000002D2B9300000-memory.dmp

                                        Filesize

                                        1024KB

                                        Download

                                      • memory/4604-1101-0x000002D2BA730000-0x000002D2BA750000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4604-1085-0x000002D2BA320000-0x000002D2BA340000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4604-1075-0x000002D2BA360000-0x000002D2BA380000-memory.dmp

                                        Filesize

                                        128KB

                                        Download

                                      • memory/4720-73-0x0000000000400000-0x000000000046B000-memory.dmp

                                        Filesize

                                        428KB

                                        Download

                                      • memory/4876-1329-0x0000000002A20000-0x0000000002A21000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/5036-1335-0x000001EB8EC20000-0x000001EB8EC40000-memory.dmp

                                        Filesize

                                        128KB

                                        Download