eead66bab28b7cac9b750e0d275118ba39547ac3f5cd3019ba5f3724a37332d2

Analysis

max time kernel
146s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 20:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe
Size

220KB
MD5

17752f2da51816eaa4072dfb75b879f7
SHA1

e0b6498c8eda5030ee6c0fc6ee05d199798ff770
SHA256

eead66bab28b7cac9b750e0d275118ba39547ac3f5cd3019ba5f3724a37332d2
SHA512

6e4b1ff8e61d5d097223d5856a1f3cd13163f135e5e4c32cc9846eef1c7a7b1262fd48629f0835882c79bde464fc7062604017ac9c08ee2f4af9a837443af0ee
SSDEEP

3072:aDa+wzNRZNrVz+Cw16Fz1L6kq7lBbVDYsAP68Q0RtPZOihym0FCmLLC8U+4vszm0:j+wzNDNZCCjvB0JEsAI0RfzHMCUd

Score

7^/10

vmprotect

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	iesuo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	urlzm.exe

Executes dropped EXE 2 IoCs

pid	Process
3628	urlzm.exe
1516	iesuo.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4584-0-0x0000000000400000-0x0000000000492000-memory.dmp	vmprotect
behavioral2/memory/4584-1-0x0000000000400000-0x0000000000492000-memory.dmp	vmprotect
behavioral2/memory/4584-77-0x0000000000400000-0x0000000000492000-memory.dmp	vmprotect

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\iexplore.exe	iesuo.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\iexplore.exe	iesuo.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\cy.ico	urlzm.exe
File opened for modification	\??\c:\windows\mp3.ico	urlzm.exe
File opened for modification	\??\c:\windows\ico.vbs	urlzm.exe
File opened for modification	\??\c:\windows\ico.bat	urlzm.exe
File opened for modification	C:\Windows\RegText.reg	iesuo.exe
File opened for modification	\??\c:\windows\urlzm.exe	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe
File opened for modification	\??\c:\windows\mm.ico	urlzm.exe
File opened for modification	\??\c:\windows\yx.ico	urlzm.exe
File opened for modification	\??\c:\windows\taobao.ico	urlzm.exe
File opened for modification	\??\c:\windows\iesuo.exe	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe
File opened for modification	\??\c:\windows\dy.ico	urlzm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell\Open(&O)	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\ShellFolder\ = "WantsParseDisplayName"	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell\Open(&O)\Command	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell\ÊôÐÔ(&R)	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\ShellFolder\ = "HideOnDesktopPerUser"	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\ = "Internet Explorer"	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\DefaultIcon	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe"	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell\Open(&O)\ = "Open(&O)"	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell\Open(&O)\Command\ = "C:\\Program Files\\Internet Explorer\\SIGNUP\\iexplore.exe %1 h%t%t%p:%//%12%10%17%18%10.%c%o%m"	iesuo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\ShellFolder\Attributes = "0"	iesuo.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	urlzm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell\ÊôÐÔ(&R)\Command	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\Shell\ÊôÐÔ(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	iesuo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\ShellFolder	iesuo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF5D0589-76A7-AF11-AB16-59306CC8D88E}\ShellFolder\ = "HideFolderVerbs"	iesuo.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4960	regedit.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4132	msedge.exe
4132	msedge.exe
684	identity_helper.exe
684	identity_helper.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe
3628	urlzm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3020	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	80
PID 4584 wrote to memory of 3020	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	80
PID 4584 wrote to memory of 3020	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	80
PID 4584 wrote to memory of 3628	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	81
PID 4584 wrote to memory of 3628	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	81
PID 4584 wrote to memory of 3628	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	81
PID 3628 wrote to memory of 2492	3628	urlzm.exe	83
PID 3628 wrote to memory of 2492	3628	urlzm.exe	83
PID 3628 wrote to memory of 2492	3628	urlzm.exe	83
PID 4584 wrote to memory of 1516	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	85
PID 4584 wrote to memory of 1516	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	85
PID 4584 wrote to memory of 1516	4584	17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe	85
PID 3628 wrote to memory of 2128	3628	urlzm.exe	86
PID 3628 wrote to memory of 2128	3628	urlzm.exe	86
PID 3628 wrote to memory of 2128	3628	urlzm.exe	86
PID 3628 wrote to memory of 5064	3628	urlzm.exe	87
PID 3628 wrote to memory of 5064	3628	urlzm.exe	87
PID 2128 wrote to memory of 644	2128	WScript.exe	89
PID 2128 wrote to memory of 644	2128	WScript.exe	89
PID 2128 wrote to memory of 644	2128	WScript.exe	89
PID 644 wrote to memory of 1332	644	cmd.exe	91
PID 644 wrote to memory of 1332	644	cmd.exe	91
PID 644 wrote to memory of 1332	644	cmd.exe	91
PID 644 wrote to memory of 3640	644	cmd.exe	92
PID 644 wrote to memory of 3640	644	cmd.exe	92
PID 644 wrote to memory of 3640	644	cmd.exe	92
PID 644 wrote to memory of 876	644	cmd.exe	93
PID 644 wrote to memory of 876	644	cmd.exe	93
PID 644 wrote to memory of 876	644	cmd.exe	93
PID 644 wrote to memory of 1968	644	cmd.exe	94
PID 644 wrote to memory of 1968	644	cmd.exe	94
PID 644 wrote to memory of 1968	644	cmd.exe	94
PID 644 wrote to memory of 3340	644	cmd.exe	95
PID 644 wrote to memory of 3340	644	cmd.exe	95
PID 644 wrote to memory of 3340	644	cmd.exe	95
PID 644 wrote to memory of 1664	644	cmd.exe	96
PID 644 wrote to memory of 1664	644	cmd.exe	96
PID 644 wrote to memory of 1664	644	cmd.exe	96
PID 644 wrote to memory of 4984	644	cmd.exe	97
PID 644 wrote to memory of 4984	644	cmd.exe	97
PID 644 wrote to memory of 4984	644	cmd.exe	97
PID 644 wrote to memory of 2472	644	cmd.exe	98
PID 644 wrote to memory of 2472	644	cmd.exe	98
PID 644 wrote to memory of 2472	644	cmd.exe	98
PID 644 wrote to memory of 4992	644	cmd.exe	99
PID 644 wrote to memory of 4992	644	cmd.exe	99
PID 644 wrote to memory of 4992	644	cmd.exe	99
PID 644 wrote to memory of 4432	644	cmd.exe	100
PID 644 wrote to memory of 4432	644	cmd.exe	100
PID 644 wrote to memory of 4432	644	cmd.exe	100
PID 644 wrote to memory of 2928	644	cmd.exe	101
PID 644 wrote to memory of 2928	644	cmd.exe	101
PID 644 wrote to memory of 2928	644	cmd.exe	101
PID 644 wrote to memory of 2084	644	cmd.exe	102
PID 644 wrote to memory of 2084	644	cmd.exe	102
PID 644 wrote to memory of 2084	644	cmd.exe	102
PID 644 wrote to memory of 4196	644	cmd.exe	103
PID 644 wrote to memory of 4196	644	cmd.exe	103
PID 644 wrote to memory of 4196	644	cmd.exe	103
PID 644 wrote to memory of 4964	644	cmd.exe	104
PID 644 wrote to memory of 4964	644	cmd.exe	104
PID 644 wrote to memory of 4964	644	cmd.exe	104
PID 644 wrote to memory of 4600	644	cmd.exe	105
PID 644 wrote to memory of 4600	644	cmd.exe	105

Views/modifies file attributes 1 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2928	attrib.exe
2084	attrib.exe
4196	attrib.exe
4964	attrib.exe
4600	attrib.exe

C:\Users\Admin\AppData\Local\Temp\17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17752f2da51816eaa4072dfb75b879f7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aa.bat""
  2⤵
  PID:3020
- C:\Windows\urlzm.exe
  urlzm.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kill.bat""
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\ico.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\ico.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:644
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:1332
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╠╘▒ª╠╪╝█╟°.url" /p everyone:f
        5⤵
        
        PID:3640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:876
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╫¼╟«║├╧ε─┐.url" /p everyone:f
        5⤵
        
        PID:1968
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:3340
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╕▀╟σ╡τ╙░.url" /p everyone:f
        5⤵
        
        PID:1664
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:4984
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\├└┼«═╝╞¼.url" /p everyone:f
        5⤵
        
        PID:2472
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:4992
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╔╦╕╨╕Φ╟·.url" /p everyone:f
        5⤵
        
        PID:4432
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\╫└├µ\╠╘▒ª╠╪╝█╟°.url" +R +S
        5⤵
        Views/modifies file attributes
        
        PID:2928
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\╫└├µ\╫¼╟«║├╧ε─┐.url" +R +S
        5⤵
        Views/modifies file attributes
        
        PID:2084
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\╫└├µ\╕▀╟σ╡τ╙░.url" +R +S
        5⤵
        Views/modifies file attributes
        
        PID:4196
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\╫└├µ\├└┼«═╝╞¼.url" +R +S
        5⤵
        Views/modifies file attributes
        
        PID:4964
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\╫└├µ\╔╦╕╨╕Φ╟·.url" +R +S
        5⤵
        Views/modifies file attributes
        
        PID:4600
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:4208
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╠╘▒ª╠╪╝█╟°.url" /p everyone:R
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:1768
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╫¼╟«║├╧ε─┐.url" /p everyone:R
        5⤵
        
        PID:4380
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:4448
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╕▀╟σ╡τ╙░.url" /p everyone:R
        5⤵
        
        PID:2284
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:4636
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\├└┼«═╝╞¼.url" /p everyone:R
        5⤵
        
        PID:4444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        5⤵
        
        PID:4016
    - - C:\Windows\SysWOW64\cacls.exe
        
        cacls "C:\Users\Admin\╫└├µ\╔╦╕╨╕Φ╟·.url" /p everyone:R
        5⤵
        
        PID:1052
- - C:\Windows\explorer.exe
    explorer http://t.248.la
    3⤵
    PID:5064
- C:\Windows\iesuo.exe
  iesuo.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:1516
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /S C:\Windows\RegText.reg
    3⤵
    - Runs .reg file with regedit
    PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del iesuo.exe
    3⤵
    PID:4568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://t.248.la/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c02046f8,0x7ff8c0204708,0x7ff8c0204718
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1672 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4402538851279165383,13127434301316245545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d795f92c0ca97353589790ec939bea1e

SHA1
8d1e9277dfc5ceb673e99467dabb5fc086d63f0d

SHA256
cd93c1ba9d536aaf2455ac39d24abd911a126a55d68eab18d1bff5ee797fb596

SHA512
10369cb4857bf6424bb09579a1d0f0f2eed8c05064b03451fdeda446f281d990870e353b0b72cc51d9049c68da8f8c37e573960b9e9296d83dae5ab1af6adfbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b82f9d9daa14ad946014585e8d33ae1

SHA1
20d7c79408ae153949d5e3064a97e93d1ca7e9c9

SHA256
1994e2e00a243abebc77d88e87be01399cca339a900908e2c6433463d5476b2b

SHA512
aa16a0640e4cbe786c536dafae35e4d531eec7d79abda6cc903c670699343f2c9005813c6f494586470d8055055b6d401ec8f94a2571e47138a5a25c8c9b5aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d92ffceb43ca8ee715c85e926216b07d

SHA1
7e97f82592f8261fcdd20e8cc013d7308c3003c4

SHA256
6bb5c1870adefe96f064e46e1b5b877151a2e09fc7174c9b796f6178faeadd5a

SHA512
d818181269f02e1bd494ebe63086a5dd1dd314b911d5e7c77bd00c000d18aede87afd6ff51576354a4bbf74ba99ed4f58ca7297edc46c425911ed6f61453084e

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa.bat

Filesize
218B

MD5
c39cf11a65520ba86f428c34bbe8729b

SHA1
4bdce91b5c7ebaa7b8bcc380596b34f06d82d9cc

SHA256
1809630e00b7ba038d2e410453e5146ebea82e15bfa0b281bcd6731605536e0f

SHA512
16f50fa9563f5e7b29a3546f655b2e9341cdde3ef3067e8466bdf29b8ceab9f27768dc63968286320f1c2f7e32b40c7fb19564806d9e7405ef2efaddf7c1a755

Download Submit
C:\Users\Admin\AppData\Local\Temp\kill.bat

Filesize
136B

MD5
6e20b488c8a63efb442c99fa1b774350

SHA1
5e8350ffa682d04713d1330c2fb695a9ef63e200

SHA256
47601bb87d8dc469ce3917a57acd225d7a722aeb8cc00e14b5a0916ca0b79487

SHA512
c7306d2205ea729275704f3e6bac749dc7d6a3f3266befd5bac0c34a9861b90b9edf9f556d6da74da80b217827ba4f1477c0e22382e2b7dbf6b8748853b0a711

Download Submit
C:\Users\Admin\Favorites\╔╦╕╨╕Φ╟·.url

Filesize
21B

MD5
6b2acb5da930b408e1add6d7b794ead7

SHA1
4febf0b63e4c6a40f88b2ba7fcdcbc32b017a9f0

SHA256
98a1d62e94aeddcf26a30d0b356b0b48dfdff0a09fff298e716f789070be2479

SHA512
bff462c7d26cc55dc4f3ba17a699d00109858d61cddc716e9d8cb51452324fe96b89de5146e00b4c5e8a549511387cc3a430f7a2820c1d3c6ea753478031ea2f

Download Submit
C:\Windows\RegText.reg

Filesize
167B

MD5
538f4e3b2be9afb04d26345829b2bd72

SHA1
7ca7d0dede8e2f13f3db026b8d8087aeb223ff5a

SHA256
7f7055a6db720fc2d107ba761746f34529149d21704bee987774cc2552b3fe4e

SHA512
96ee8c9811a67bbb2e31b184cba2adae8ddcefd11df9ca7b70e7aca069fa812717f7c18f6e69fcec92184593e4632ff6ed71564db5817ed0fdbb3a5fd33acecb

Download Submit
C:\Windows\iesuo.exe

Filesize
156KB

MD5
cd793db0e7732df59509819a9dcab205

SHA1
21dea26481e08c11793aa4c62fb4b25d5d8a03e0

SHA256
1615e8f4beb8eb2f25a5cbc2b8eb79c5b2de3dc14cbc77be4b881975584842cf

SHA512
1bef34188b57a82bccfd5aa4293b3c08e001ea4c9c348fbfe20e64ce61c6445564cff8ac964d2d5257d6232ec5a5b0e145f940e1f7158d0cbe170da077ac4c0e

Download Submit
C:\Windows\urlzm.exe

Filesize
80KB

MD5
cdf7696202055858ff628092f1c8079d

SHA1
832aa1caef5ff8e13f61294986bc3e29e350b3d3

SHA256
834ca6b6eca8283c950f356f09c12014b7298908eeda2f985c4d920ef97a0a71

SHA512
58232e3989e8ceb89be572bc896af4da745bbbe4f9b3a61f47f64f77024f628d455d4b24246e1600f512cfef2f5caa554dedf6909a4211ed0a13cc28159926b8

Download Submit
C:\windows\ico.bat

Filesize
3KB

MD5
b6fbd77f9dcfafcbde0b51e62107c9f5

SHA1
884c06bf9cdef016418724a65529cc906157b61d

SHA256
59cc52947185c4e52f738455a6083b9593e4f58f89a2e212a37abfcf03d335a9

SHA512
b488b8926071d46a554a5f1b25b3aae7a5b7425155e692ddb48f1d26c31a6ab6b611757e7109ef99e2fc58cde4f33bb1cf33a09b5352fd08238f8dc7f9cbbd8e

Download Submit
C:\windows\ico.vbs

Filesize
96B

MD5
a1bb4a347f1d8506df362f997d31145b

SHA1
7da20159ffc308c0d7e0127b7afcbf8b1f3886fb

SHA256
0492f2a51255aa2bd5979fd5f4f0fd6539f08c85006c34123f204b0b49c8dfc3

SHA512
76a0c7d383bc2cd9eb838f48bb310e7a778bf2897c393aa47ee238fa89e8811e87e55b7f1b9027d26a207c303eecd065047d87a2cd8d4dfc198e4e5bad67f428

Download Submit
memory/4584-0-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4584-77-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/4584-1-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download