Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 15:42
Static task
static1
Behavioral task
behavioral1
Sample
07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe
-
Size
18KB
-
MD5
07665c23ca68173f7490e11482c898ae
-
SHA1
358bfb2d3f364d99b7a0699e07a763d4b06ccfb5
-
SHA256
a6de0c5b37fde764b88464df279ebef8f98dcb55e2972240be32327837987555
-
SHA512
086387998f5345121e1bece26e93e33381dde4a39bac3ee5dae561d822d5a9d860aba5b2572d957fa84a3960a00448c06f0a67cd57acaaf39d66042ea3160ef5
-
SSDEEP
384:bwM8LEwbriEgjoES76z3h/jpiT2fkn9fHiSNf0ve0OxCGGqrt8YKvITtK9C:k3LEyts0GtdIVfiSN820OxPtrHKK8C
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2444-0-0x0000000000400000-0x000000000040B000-memory.dmp modiloader_stage2 behavioral2/memory/2444-1-0x0000000000400000-0x000000000040B000-memory.dmp modiloader_stage2 behavioral2/memory/4268-6-0x0000000000400000-0x000000000040B000-memory.dmp modiloader_stage2 behavioral2/memory/2444-7-0x0000000000400000-0x000000000040B000-memory.dmp modiloader_stage2 behavioral2/memory/4268-9-0x0000000000400000-0x000000000040B000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
07665c23ca68173f7490e11482c898ae_JaffaCakes118.exepid process 4268 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
msedge.exeiexplore.exeIEXPLORE.EXE07665c23ca68173f7490e11482c898ae_JaffaCakes118.exemsedge.exesetup.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOCK msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB\LOG msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe576810.TMP msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\History-journal msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001 msedge.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b8877e8b-bc25-4a49-8ef2-65b42e2b7aa8.tmp msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-journal msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\47fd8c1c-9d8e-4889-b73a-15835e732174.tmp msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\lockfile msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2 msedge.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\2d8c2cb0-e3ac-4a55-9b5e-a27a1ba78e1c.tmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\d7c2cbe9-2c4e-4cb2-8e1f-89c0beb4aaec.tmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOCK msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000001.dbtmp msedge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico~RFe5740a3.TMP msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index msedge.exe File created C:\Windows\SysWOW64\07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ADE1580F-2F1B-11EF-8383-56995CF5AA0C}.dat iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Version msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000003.log msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\index msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Last Browser msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\85bda22e-94e1-4132-bc2c-87524e0d73e2.tmp msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000001.dbtmp msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\favicon[2].ico iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe577b0c.TMP msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\0d06abd5-b47a-413c-81d1-bcf6e4463dca.tmp msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001 msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\Favorites iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\warnStateCache msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0 msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG msedge.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOCK msedge.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp msedge.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\33cc8cd9-22ae-4a8d-9b0f-5a54c08b9ecb.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240620154225.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
iexplore.exeIEXPLORE.EXEmsedge.exesetup.exemsedge.exemsedge.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Flags = "1024" iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice\ProgId = "MSEdgeHTM" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\StabilityMetrics msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\jdiccldimpdaibmpdkjnbmckianbfold = "DC53006DC9942F5C49197C7B6ADC691461EF1D3293142836BDBE2A0518D2A7FA" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = 3c49120569bcda01 iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\settings_reset_prompt.last_triggered_for_startup_urls = "A919955997DB30C8FDC662B9797EBC6AC61B582B61351971E5DD093C4C394D07" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\AppXvepbp3z66accmsd0x877zbbxjctkpr6t_.epub = "0" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\ihmafllikibpmigkcoadcmckbfhibefp = "9020AEA020B652FBA61E92AC9541839718CEB0E6DF2177C9606D4710DBCE6133" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\homepage = "67140D3FA18E8732D85FEBF25A7145F55DBA71E189F52E3937FCAE16AF33ED57" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\Extensions msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e8070600040014000f002a001800e80101000000644ea2ef78b0d01189e400c04fc9e26e IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings\fikbjbembnmfhppjfnmfkahdhfohhjmg = "873FA5B1A60E3BDB5E78873AF32756DE7C1CA587B9889931FDA390439A3350EE" msedge.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = 3c49120569bcda01 iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\extensions.settings msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\MSEdgeHTM_.mht = "0" setup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids\mhtmlfile = "0" setup.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000063d9fdfe1838ef42916d3a9ac478c5f300000000020000000000106600000001000020000000a644b4867257bcce0e6a513174fc23773543585f911a5da2df3dc136ea549e25000000000e800000000200002000000022f3558c787bb11c7d881dc04deeaa1347ee5924dcdddb8cf2585e6e9e0f7a4210000000d2e02689d689eeb2e553a4ba7298c8be400000003902e1860dfa876fdc461ce50757b151f191050c5b5f00f01510c41c6a4c3a0f63214717739b5e959c602254511a76b16ee454bbab4e9129f43d8f88aa86fa8c iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html setup.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000063d9fdfe1838ef42916d3a9ac478c5f3000000000200000000001066000000010000200000000822f30a88b1644955906ec4809bdfdd1ba8158d70095f8db76cb717a039f8bd000000000e80000000020000200000004142207718b53fc393e74399220e3bec7e25bc0385d58b47a1a321020795dd43f003000038f7ecd13d5a6426816f4b22eb6ce92f113af1e05de11d78a357bd1f4539e2c1d33b9d7a4ea8a5596b4d814180781a2998699229788a81bad8691bc646cb268871a020f162ca239e81b75776be09f56857fc3c212003814a193a0feb41af3432ff1a2ecdbc38b28b7889b9d30a0c312bb069ba0972265720e8c5fb7399ac5109e291296918a83fb0d3576943bf9214704842e5809adfd50580e8c0e138ccbbab27c0d1b71c8c3c6438df183aff459c0d2a19152b16a491355e433e7257da7207a1d41045caa7786c6212cbdb4614481a506b0a12661277969cfb826a861281155f28882cb2764954b6e270dd60e77e4d31c3659a1d8b4c34641c10a82cdbcda2ca2aea700c39cd1495027a43f52cd2f9002a8cda9e2085744921c488f94a1aa410a7a10d84aa9a8100f427a276606cc7879c1145ab874598edea621fc5250d1af36e8ecbdfa5c3142168aca8a20b233cf3fc28894cfd6f91d869d5aebade5079d1f2c8c6ba8b9d2d975cedc7a8fd8e9cd34a381cf3d09600a264094a85bbd5130a7eea47848fe05467022ae17e7c77fd8db06eaa678d3b4129d1616e34c9a90ba5c28c8801ca0253f76b687d32aa481a4a781b8965c3b0ddedc7fcb07d09851b864247c34194af16eac666302e0d6cffa864087d3bea8ffb150c00ebff7d0555670a613e7010490ad7be5b4aad563079692834fff3b77d4d6a93640f0e179458b7d774c6729c27c6601603752760c482dd082c89b2096574a25cede52c7b261bd5a445a07d406a615a175209985017db8606fb570977630df6729c71ce24f2caa9de71e0cdedec7c3cabdd5feaaa49c4c025e02ad8684d19e42ddc25a4622b50211685415dc8355fa6de76c17bca93e0367d64d37def55a1765816e71371d1a9cc7ea08e7ae947b4582a7d8396b96b0b1f238e1839b3d1007bf1e18c65cf76caaf909ec3d207dcbb69e9718713f2a50d1cbce46609264e1a2f6a27938216c278e892d2d6a12e7f2c02994d5b1d3a5aceae98d3df916007c419629d678952204b027514af996258f9cbbaed12b4290bdf34498b63f3217c54a8bd6e63e4b75829cd768145e9884ea6f381b3dba298d6d7488e8461100b1a7c34864c9bcf2bdd3904fbef4a1831c3b8cd9549a4d0c5d5f05880eb220abd246fc78cebc2244a1a0e2f8ee6ba5c042e11f54c874ca08ef91c34be5b71b6ecb4454915aed5dab5774dc15b87abf72ee133d1ba1c5c034344f65aaee2e78a1f58fdad1deac64cff0249f6d037e7b2f809c02a09bcc207421e5670e084963fd392bcbd886a58736ab7cf12e335b1d2580a4a9f1fc677186fb20fdf30c69511daac71afc84f1d7c4a8b7298cf4f6537a411a4005e3d568cbb2517506363fc5796b05a5836b0dd3ebcd9ecc4187d3ce1e116839b71f60101828a37400000007584d071bfcfcfe45ced3426fcfc755c1e337c84d3d471e7e037e94574f684fe9003430b38a03e368e7ac72d7ea8f46695a7e5a07fd941d5839e49b445175449 msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" iexplore.exe Key created \REGISTRY\USER\.DEFAULT msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\UsageStatsInSample = "1" msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon\state = "1" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Suggested Sites iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice\ProgId = "MSEdgeHTM" setup.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}" iexplore.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Feeds\MUID msedge.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018400FA672BAF6 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000063d9fdfe1838ef42916d3a9ac478c5f3000000000200000000001066000000010000200000008950262bcfb4bf035c587241199846a2f6c5ea2683b342819438208440b0ca80000000000e8000000002000020000000c89c8aded3c4f3d9115ab10bd1d45ec6f5a66a1813b1df5f9639d64c283d5017800000002a15fd5b6ca1037308cf798c08440be3ebad3de21093311972d143c6e4660196345778fd61ace51584961d41c71ce66426dd90a88c0cd6b607243a26fcf1c9459b7c2579cd1a241ac819c615a9bf86a54900d0c3733b58473782ca63f3649ec2201ad969f172740c417fa68df475289f23758ab4bd3a3829a019167335d96509400000007511fb0c42ae1e3e3d3b1871e5f497c28a6d7ccb0308a107b18f1851b37e3233dada6514d8e0a7477922de3052e1665790b14b865a97b1af7e5ab399568d274e msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\PreferenceMACs\Default\media.storage_id_salt = "D66B7F6414D343DDC039C39B52CDC5C5A5F84A26DA382A3B3F33385BBD995DA0" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Flags = "1024" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice setup.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
07665c23ca68173f7490e11482c898ae_JaffaCakes118.exemsedge.exemsedge.exepid process 4268 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe 4268 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe 1376 msedge.exe 1376 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
07665c23ca68173f7490e11482c898ae_JaffaCakes118.exedescription pid process Token: SeIncBasePriorityPrivilege 2444 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
iexplore.exepid process 4912 iexplore.exe 4912 iexplore.exe 4912 iexplore.exe 4912 iexplore.exe 4912 iexplore.exe 4912 iexplore.exe 4912 iexplore.exe 4912 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4912 iexplore.exe 4912 iexplore.exe 3268 IEXPLORE.EXE 3268 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe07665c23ca68173f7490e11482c898ae_JaffaCakes118.exeiexplore.exeIEXPLORE.EXEie_to_edge_stub.exemsedge.exedescription pid process target process PID 2444 wrote to memory of 776 2444 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe cmd.exe PID 2444 wrote to memory of 776 2444 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe cmd.exe PID 2444 wrote to memory of 776 2444 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe cmd.exe PID 4268 wrote to memory of 4912 4268 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe iexplore.exe PID 4268 wrote to memory of 4912 4268 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe iexplore.exe PID 4268 wrote to memory of 4912 4268 07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe iexplore.exe PID 4912 wrote to memory of 3268 4912 iexplore.exe IEXPLORE.EXE PID 4912 wrote to memory of 3268 4912 iexplore.exe IEXPLORE.EXE PID 4912 wrote to memory of 3268 4912 iexplore.exe IEXPLORE.EXE PID 3268 wrote to memory of 3128 3268 IEXPLORE.EXE ie_to_edge_stub.exe PID 3268 wrote to memory of 3128 3268 IEXPLORE.EXE ie_to_edge_stub.exe PID 3128 wrote to memory of 668 3128 ie_to_edge_stub.exe msedge.exe PID 3128 wrote to memory of 668 3128 ie_to_edge_stub.exe msedge.exe PID 668 wrote to memory of 2736 668 msedge.exe msedge.exe PID 668 wrote to memory of 2736 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 3720 668 msedge.exe msedge.exe PID 668 wrote to memory of 1376 668 msedge.exe msedge.exe PID 668 wrote to memory of 1376 668 msedge.exe msedge.exe PID 668 wrote to memory of 1828 668 msedge.exe msedge.exe PID 668 wrote to memory of 1828 668 msedge.exe msedge.exe PID 668 wrote to memory of 1828 668 msedge.exe msedge.exe PID 668 wrote to memory of 1828 668 msedge.exe msedge.exe PID 668 wrote to memory of 1828 668 msedge.exe msedge.exe PID 668 wrote to memory of 1828 668 msedge.exe msedge.exe PID 668 wrote to memory of 1828 668 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\07665C~1.EXE > nul2⤵PID:776
-
C:\Windows\SysWOW64\07665c23ca68173f7490e11482c898ae_JaffaCakes118.exeC:\Windows\SysWOW64\07665c23ca68173f7490e11482c898ae_JaffaCakes118.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4912 CREDAT:17410 /prefetch:23⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=40002c4⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=40002c5⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcea8846f8,0x7ffcea884708,0x7ffcea8847186⤵PID:2736
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:26⤵PID:3720
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:36⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:86⤵PID:1828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:16⤵PID:4964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:16⤵PID:4988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:16⤵
- Modifies data under HKEY_USERS
PID:1360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:16⤵PID:2888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:16⤵PID:3404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:16⤵PID:2092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:16⤵PID:2596
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17448208704631318961,6786661758045891213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:86⤵PID:2316
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings6⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:3096 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff7a0a95460,0x7ff7a0a95470,0x7ff7a0a954807⤵PID:3092
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4832
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD507665c23ca68173f7490e11482c898ae
SHA1358bfb2d3f364d99b7a0699e07a763d4b06ccfb5
SHA256a6de0c5b37fde764b88464df279ebef8f98dcb55e2972240be32327837987555
SHA512086387998f5345121e1bece26e93e33381dde4a39bac3ee5dae561d822d5a9d860aba5b2572d957fa84a3960a00448c06f0a67cd57acaaf39d66042ea3160ef5
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize152B
MD5b4380d25ba92d04d3d83cea8d211db07
SHA1e3170311d3b47b7a98f0694766bc531fefcfe13d
SHA25604f90ff9c778213cd270f1d3d148763262758a6dba82e64f995aa5c076e93626
SHA5126b2cd861d62c5a57f1c101d98b362bd03418694dfdab09ae06e7282cf696877c930a9297034fe89954a92809cab20e04bb1dd81e4bfe19d21c8a043df629442b
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\8f2f316d-a2c0-4579-8144-97a3ee1babf3.tmp
Filesize111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
3KB
MD598a7a5253c0a573a62ec4637c987f5fb
SHA10a941eb8a31809fc5a3b4b516388173c16fbeda2
SHA2569e2c35bb9ad55f306d607eea7522873b687592091f5e53c4d3a487d1bf8c902b
SHA5127559696390e4799a36ad497a855aa2f0c092e760ffaf24adf064fa5816686aa38274ad8668e650363cffc2a607ae257fc020a3cef5f86c121635376f1daa9670
-
Filesize
4KB
MD5b793dbc2a5d5e415f4416ce8b39a75f9
SHA1e1ffc2eabe8b7e40bc660a0a626e9b96902a3183
SHA256b8335d3f587da6454cb506527e4e660eed70314b079f93c9583fbca89f784849
SHA5121d59de0a8b455977cf8696c82309cf03780a50148e14a0b64f9a1647ddbd43b8f1c3c5259a63f56d3209b96b417585b217c6fad761f35a26ab7d688781631510
-
Filesize
5KB
MD584f6628a1309303648ac7358619c145f
SHA1e51051b6975c80fc76f69b9c2467c2007ff68feb
SHA2562742e23dcce0db5c16d13ddd7fd648daf7402795f5e7eb016b049ef56d956b8e
SHA51204d68acc83039dbce75c7621a1adb1f291035efea930aa9cd38f526c405c31486a9ec3baeef39a34c9f1182a2ea03cfcc6839faed322476bd5b5cbbbd3f88f8b
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe57420a.TMP
Filesize3KB
MD5dbc0e7a9424f0de6cf86310cc6deb99f
SHA1c8cbb87e8d51e17cff6b2950599eab947d39b556
SHA256179e0a013af6ce46ebd2cb4b31ac3dcded13503b2668489f2c5972f3873548e1
SHA51299978206f789adcac6169ba8938c671dc809f1762368eee2dd008df99f5b41fe8a9de81c7da481aebba176aa14478e4d7937a01e05ab18348ced0e3a7909c0a9
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize24KB
MD52e1df851a916befe05318eac0767836f
SHA17c10d3f8c52e5adc118a0c03795677c61795b10c
SHA256f3d6144e9fe82e09b3d5c1a80e196c79a0ccc23e9c8a3d1a03fd2cf3b8a0b83c
SHA512b97f599c9927619e5b13439c6d1c9c16e94c0d56fd22c6238180adb4a5685346e3480012a0e84d9e94334e9135337d86e14cbad5503342f03a97a2d341606621
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RFe5768dc.TMP
Filesize24KB
MD56d65dcb7e17a87c48bbb379cb86c5782
SHA1d56134e8fbdad569b6ee0b783b65b99f67652940
SHA256d896482ca56181683bade681ce531259cada0cc74e9920986110eb61cfa8b940
SHA5128d851c393986004117d88c5569ca3a7970ccaddaa606d6c4d86cc223de60d25703528d0933f4b6d7899bf329704c5f6c3994a6b49b008bc3df11e4e52eca9384
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000001.dbtmp
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\b8877e8b-bc25-4a49-8ef2-65b42e2b7aa8.tmp
Filesize70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Filesize8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Filesize8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Filesize8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\ec02f14e-61eb-489a-a7a7-fa1263257936.tmp
Filesize10KB
MD583257fe3af2a1ceb085685bda7f0f052
SHA16eddb536951dbddbacaabc56dbc20dbe5bda14a5
SHA2568b6bd44afa9b9366b72f827291d455d18f7f81fb2bc8ac0e77d596e605727754
SHA512c3debf10e2dd0eba7ce7afd386b37c13b0f956d46d9d7d87e03c1e0caf810b51892f777a93e12931f18ede3fbdafaa9440ca3f6b0957525b42314c6c14e80ee1
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
402B
MD5881dfac93652edb0a8228029ba92d0f5
SHA15b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
-
Filesize
88KB
MD5002d5646771d31d1e7c57990cc020150
SHA1a28ec731f9106c252f313cca349a68ef94ee3de9
SHA2561e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
SHA512689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize152B
MD565f36e1b733209b8d1f191fd3c70d17e
SHA1099156da7d0ceee0bac2a49d87b9e17c9f6d1072
SHA256f3696ccf536edc86edc26e47aa4743b37567ef422123406e9e699849e3486369
SHA5129dcca52f6387a2b6a27677a9651bf96f025fbd17287ec70a722d1f0ae5f11a4fda09e7815de2bd3e78256286d9a2f20a56deeced31daefc052f8994782a9e7cb
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Edge\User Data\Crashpad\throttle_store.dat
Filesize20B
MD59e4e94633b73f4a7680240a0ffd6cd2c
SHA1e68e02453ce22736169a56fdb59043d33668368f
SHA25641c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
SHA512193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e