163649231f5422ad974ff6edb760b3eac67c17c15440e4dd4d286b54b87e9567

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
Size 130KB
Sample240528-aahxesgb23
SHA256 163649231f5422ad974ff6edb760b3eac67c17c15440e4dd4d286b54b87e9567
MD5 7b013a3308489cbabb6964a744bc70ee
SHA1 7ca649f902dd834132eec0d5562cfefc01682a14
SHA512 1faf5f785a03f3417027e5dba658f57c2b3b9f237ca7ad7ce2258ca3717f48ae89b4ac3632a3d250ac1c250da6858875bba25b34be84aaaea8987233620eab33
SSDEEP 3072:fQIURTXJ5Wftg7r/TznRcM4zLp2Px4parR4wXi5:fsTWfy3RcM4fpi0aV7c
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	9377mycs_Y_mgaz2_01.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	MYLogger.exe

Executes dropped EXE 5 IoCs

pid	Process
2744	9377mycs_Y_mgaz2_01.exe
1148	MYLogger.exe
1432	MYLogger.exe
3092	MYLogger.exe
2236	MYLogger.exe

Loads dropped DLL 34 IoCs

pid	Process
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2744	9377mycs_Y_mgaz2_01.exe
2744	9377mycs_Y_mgaz2_01.exe
2744	9377mycs_Y_mgaz2_01.exe
2744	9377mycs_Y_mgaz2_01.exe
2744	9377mycs_Y_mgaz2_01.exe
2744	9377mycs_Y_mgaz2_01.exe
2744	9377mycs_Y_mgaz2_01.exe
1432	MYLogger.exe
3092	MYLogger.exe
1148	MYLogger.exe
2236	MYLogger.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\9377÷ÈÓ°´«Ëµ.lnk	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\Feisu8\Uninstall.exe	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Feisu8\Uninstall.exe	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.ini	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\uninstall.exe	9377mycs_Y_mgaz2_01.exe
File created	C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\replay.htm	9377mycs_Y_mgaz2_01.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a00000002339c-65.dat	nsis_installer_1
behavioral2/files/0x000a00000002339c-65.dat	nsis_installer_2
behavioral2/files/0x0007000000023427-127.dat	nsis_installer_1
behavioral2/files/0x0007000000023427-127.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
1816	msedge.exe
1816	msedge.exe
2984	msedge.exe
2984	msedge.exe
636	identity_helper.exe
636	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1432	MYLogger.exe
1432	MYLogger.exe
1148	MYLogger.exe
1148	MYLogger.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2744	2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe	99
PID 2708 wrote to memory of 2744	2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe	99
PID 2708 wrote to memory of 2744	2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe	99
PID 2744 wrote to memory of 1148	2744	9377mycs_Y_mgaz2_01.exe	100
PID 2744 wrote to memory of 1148	2744	9377mycs_Y_mgaz2_01.exe	100
PID 2744 wrote to memory of 1148	2744	9377mycs_Y_mgaz2_01.exe	100
PID 2744 wrote to memory of 1432	2744	9377mycs_Y_mgaz2_01.exe	101
PID 2744 wrote to memory of 1432	2744	9377mycs_Y_mgaz2_01.exe	101
PID 2744 wrote to memory of 1432	2744	9377mycs_Y_mgaz2_01.exe	101
PID 2744 wrote to memory of 3092	2744	9377mycs_Y_mgaz2_01.exe	102
PID 2744 wrote to memory of 3092	2744	9377mycs_Y_mgaz2_01.exe	102
PID 2744 wrote to memory of 3092	2744	9377mycs_Y_mgaz2_01.exe	102
PID 3092 wrote to memory of 3432	3092	MYLogger.exe	56
PID 1148 wrote to memory of 2236	1148	MYLogger.exe	103
PID 1148 wrote to memory of 2236	1148	MYLogger.exe	103
PID 1148 wrote to memory of 2236	1148	MYLogger.exe	103
PID 2236 wrote to memory of 3432	2236	MYLogger.exe	56
PID 2708 wrote to memory of 2984	2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe	106
PID 2708 wrote to memory of 2984	2708	7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe	106
PID 2984 wrote to memory of 1264	2984	msedge.exe	107
PID 2984 wrote to memory of 1264	2984	msedge.exe	107
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 840	2984	msedge.exe	108
PID 2984 wrote to memory of 1816	2984	msedge.exe	109
PID 2984 wrote to memory of 1816	2984	msedge.exe	109
PID 2984 wrote to memory of 4712	2984	msedge.exe	110

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432
- C:\Users\Admin\AppData\Local\Temp\7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\nsw8A02.tmp\9377mycs_Y_mgaz2_01.exe
    9377mycs_Y_mgaz2_01.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
      "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
        
        "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" "1"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2236
  - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
      "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" 2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1432
  - - C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
      "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe" "C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll" 1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://k.alishantea-tw.com/7b013a3308489cbabb6964a744bc70ee_JaffaCakes118.exe/40.jpg
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb517046f8,0x7ffb51704708,0x7ffb51704718
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:8
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,109032955968072516,2508062545114572740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1860 /prefetch:1
      4⤵
      PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MYLogger.exe

Path C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.exe
Size 377KB
SHA256 cc6d069c6e4ce7da54901094753cd9df36dcb095b9ead758e809887c2643a5ba
MD5 e62edf270beee5820e781404b6792cbc
SHA1 b4a31e93ee812786deeab21fc990e1fa72d18f20
SHA512 d0a208e4e692114e0ecfce35c9e33ab69296484b632446f04e8cebd3fef52b4e7fed5877f2321e179a1cb6a822161a6d31370a68b19cc5277819cbbc350c159a
SSDEEP 6144:z2QvquuntAgXQD1Z2NTV1TpJhsmzILw3npuHTlM2zccEYodcyVv:VeAfH2NTV1TpJhsH83puxM27wn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MYLogger.ini

Path C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MYLogger.ini
Size 230B
SHA256 170348f44bf8ba6a3ba4b9f84480cdcfa89e61f9dd241581c8fb9ee84ad354b1
MD5 a3e565d51890915c892fb68ce381ea1f
SHA1 fae73b21edf8b59020e2427ea5642158177b04d0
SHA512 82df86e459aa3a1cd68ab4e77ca30d5e6e1e4b9a181769f9be362199239ff39d76ca484a1dd34283cfeee7cf6d4a49534eee1bf5a7f868d7b0e3acc4ae301a93
MD5 SHA1 SHA512

Submit Download

MeiYing.dll

Path C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\MeiYing.dll
Size 463KB
SHA256 aab3e362c47d454e48f265213bab6e582c3b5c6b7167e54d477c68b9d3dc5b8e
MD5 b383bf5a47c46d6a22b1c3d383edc87c
SHA1 abfac8a4beb27df27fe9353ed70a30677f7bcaed
SHA512 92618f2db31110bdcb2937a8dc44a81640be8ff589266ade343c9301ee7bf1479995c6b14b6f06e52c2b1e52c4c91f254ca58d664a1cea10e1a1b2d1cf292d29
SSDEEP 12288:N67P+V2NHa6VpNK24jhpw9EG3BTSJPb1Jv:ata6vktpw9PBTo1Jv
MD5 SHA1 SHA512 SSDEEP

Submit Download

uninstall.exe

Path C:\Program Files (x86)\9377÷ÈÓ°´«Ëµ\uninstall.exe
Size 76KB
SHA256 68237bdfcda9fdf8747e65df044a8b3668ea5dd26451335e78bf311999cf05e5
MD5 1d4b24538bde98104eda1b5d3cff1fc5
SHA1 2f766c1fbdd8632ec9784d9631a5c74dcaf77f4a
SHA512 985e0f01e8c186767b2025e5b0b253ac1aec8bf7145028f7737315998d0ec92ab42c80fd4722ac98873dd2ac1a3bbc3f8b6a4164cfe10865efec7b15c56215f6
SSDEEP 1536:pQpQ5EP0ijnRTXJJhjBuPGlTNWFY6vwGo9tL:pQIURTXJnQGRWFY/z
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9059bf9b937fc400922b8937f2436f315adb55744499f60ee83fc4b1373b3cc2
MD5 2b1876e1a09e6cd94fba1cf534f8a42f
SHA1 a6e1ba1cf0d015dda5ba3d89eba40be2f10cba5d
SHA512 cfb97fc735a76f0db749ee12a54fd9f6271fe5c31e1591a08239e77b501e56ea414cdad398d4aa97662e8e8fd666cb09757c3435aca04ead37d243575632aef9
SSDEEP 96:ntkW01thwpvWMoiVmdeHBrzeFPUWQyV+VDCziEwb:ntkPThGWMXKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

c6e2cd41-195d-4b0b-9584-515fa97f455a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6e2cd41-195d-4b0b-9584-515fa97f455a.tmp
Size 6KB
SHA256 86fc3495dfe4e638bc2d51ef76cac18dc11c9feffdd544e20f2466e9e6b1aa7f
MD5 5cebf685f71bd821130d112720201e48
SHA1 a21ef7d292f6a3a957601b3e61eb26b16fb18d88
SHA512 c12c9c39a6bacaf1584a81dc094818f7ba908b6ad0db81a58a29d00190a1aa8a2564608517f4f0bed9e75cbbf0d300d0a0dc909a6da566bee36f54793023c432
SSDEEP 96:ntkN01lhwpvWMoiVmdeHBrzeFPUWQyV+VD7AiEwb:ntk6PhGWMXKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 836afc1e4ddd3a09c1679ce0b897a917dbf49f7a83e1b649e12608762e2f2c49
MD5 660ecbe9c9e98d783cc133afbae3215e
SHA1 f470a0a0f2f94c922f887af83710cb2db7ef616a
SHA512 d94ce4c8afb2f46074b83382b98324b98a66473965b51c81f42825d6a35ba8e10c515e94e67fa4de720ff07bbd28458f9dc3eb04bca45a1767145f204fb4e5e4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupeHSe2RU6Mj2T3z2OMDCRH0:A9iIxuERzA83h09RZxYeHscyTaOMWRH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso33FE.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ip.dll

Path C:\Users\Admin\AppData\Local\Temp\nso33FE.tmp\ip.dll
Size 16KB
SHA256 7744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4
MD5 4df6320e8281512932a6e86c98de2c17
SHA1 ae6336192d27874f9cd16cd581f1c091850cf494
SHA512 7c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b
SSDEEP 384:BT4+VFqw6WBEyzsyHTsOrohCXgmXBEeGc:vVFqwfBEyAy4OPKe
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.ico

Path C:\Users\Admin\AppData\Local\Temp\nsw8A02.tmp\1.ico
Size 160KB
SHA256 862709c2c33bc7df87b87a50f03350d8068cdbddaccafd7a4b56235a653a326c
MD5 617d3ff30e6b8046e484ecc404841196
SHA1 cd728b4a93d7ce009a481aa415e3f4196972a46e
SHA512 ba0a1bc813d262c94736325356e777e4b6d76f9eae1d0bce95965376a9345106c444d1e2d3cb84ae4ac8d5067f110dbc1fbc386eb9b55044b238f61b81a3f084
SSDEEP 3072:dlHwaEYaX8qqqqqqqqu6O2qv5S44zCI803QeRI:dTEHX8qqqqqqqq656zCI80y
MD5 SHA1 SHA512 SSDEEP

Submit Download

9377mycs_Y_mgaz2_01.exe

Path C:\Users\Admin\AppData\Local\Temp\nsw8A02.tmp\9377mycs_Y_mgaz2_01.exe
Size 649KB
SHA256 dc0ddb5f676959234ec39c703187a741af91d8e6e17d084dfa256f3770336366
MD5 11a03edd815fdfde672df5e0c9db1ecd
SHA1 3612f55ae04e0f937d797f9c818a507e5b46011d
SHA512 6f82ad5153f501ff294371a12c7e82a9c15b3c0012bb2c39b04aa71ee2b2d4548b1e3c3418cd8e9a9d3eea048befabfd7a9ed8cd949eef53d86a3567814f6a12
SSDEEP 12288:pIgDiFFpPrscKgZIZeCUjHavW34Zli3ArUw+NSMVTVCYo6XrZMHT:pI6QpPrNqcCU+5gEuvTV5rZmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw8A02.tmp\Inetc.dll
Size 20KB
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw8A02.tmp\NSISdl.dll
Size 14KB
SHA256 fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
MD5 254f13dfd61c5b7d2119eb2550491e1d
SHA1 5083f6804ee3475f3698ab9e68611b0128e22fd6
SHA512 fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
SSDEEP 192:t5ZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRYgsfA:fBo/680dCI5adOjFOg9//p27uNw2bo
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw8A02.tmp\System.dll
Size 11KB
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw8A02.tmp\nsProcess.dll
Size 4KB
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

Submit Download

Intrenet Explorer.lnk

Path C:\Users\Admin\Desktop\Intrenet Explorer.lnk
Size 1KB
SHA256 21410d86c4dc420678e050361fcab90bf1b12b9498fa30cec3b6e35c486c7024
MD5 39ffcfd7d604c4f5b4a35d7405fd7956
SHA1 265f76ef08b4464291872f773efd69ac60a2d8e7
SHA512 49ec368851dd7e89389e51256a46e129c0c4c4153d5d43aa078889e8a3f2d1cbf97cf6f05dc64d6d66a5a2e238a0be86e634860802517e0898452a060ded3d94
MD5 SHA1 SHA512

Submit Download