Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
2d098beb4c406ab2c2b3c273d6a61c9c_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2d098beb4c406ab2c2b3c273d6a61c9c_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2d098beb4c406ab2c2b3c273d6a61c9c_JaffaCakes118.html
-
Size
10KB
-
MD5
2d098beb4c406ab2c2b3c273d6a61c9c
-
SHA1
6d2cc28321c3a9d1d8f712a4122dadc11dddf840
-
SHA256
744656223f15bbb63fed6f716073cc765ea3efd6d322f836fbfdece875dfe576
-
SHA512
7de1a258699911330c1e3b22f54aaa96e8d51137690c03d2322388efaa01f18f756fcda8038cf1d7a20ace19092915c077a8ea12cd85fc0bc229d5336c428d46
-
SSDEEP
192:NRf7qYRsW1/xMuX8PFRVljR73UkAn0zuepxW7e:3fYN3hAnVq
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2832 msedge.exe 2832 msedge.exe 4016 msedge.exe 4016 msedge.exe 5884 identity_helper.exe 5884 identity_helper.exe 5384 msedge.exe 5384 msedge.exe 5384 msedge.exe 5384 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
pid Process 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 768 4016 msedge.exe 82 PID 4016 wrote to memory of 768 4016 msedge.exe 82 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 3468 4016 msedge.exe 83 PID 4016 wrote to memory of 2832 4016 msedge.exe 84 PID 4016 wrote to memory of 2832 4016 msedge.exe 84 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85 PID 4016 wrote to memory of 1972 4016 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d098beb4c406ab2c2b3c273d6a61c9c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c89d46f8,0x7ff8c89d4708,0x7ff8c89d47182⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:82⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:12⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:12⤵PID:5208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:82⤵PID:5712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6484 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9300 /prefetch:12⤵PID:5900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9288 /prefetch:12⤵PID:5908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:12⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:12⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,3783473841292577955,10571796743264945138,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5384
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a27d8876d0de41d0d8ddfdc4f6fd4b15
SHA111f126f8b8bb7b63217f3525c20080f9e969eff3
SHA256d32983bba248ff7a82cc936342414b06686608013d84ec5c75614e06a9685cfe
SHA5128298c2435729f5f34bba5b82f31777c07f830076dd7087f07aab4337e679251dc2cfe276aa89a0131755fe946f05e6061ef9080e0fbe120e6c88cf9f3265689c
-
Filesize
152B
MD5f060e9a30a0dde4f5e3e80ae94cc7e8e
SHA13c0cc8c3a62c00d7210bb2c8f3748aec89009d17
SHA256c0e69c9f7453ef905de11f65d69b66cf8a5a2d8e42b7f296fa8dfde5c25abc79
SHA512af97b8775922a2689d391d75defff3afe92842b8ab0bba5ddaa66351f633da83f160522aa39f6c243cb5e8ea543000f06939318bc52cb535103afc6c33e16bc6
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD557d8849e90e803141f60e348ea55f3fc
SHA1bbdd8326fb3229aa3dc6a074326eada37d9fcc5f
SHA256877168b98eb9d26de23d1d085b453a351fe8191905d55e44faf25b0a409441ca
SHA51238ba4d89f6dc37c5361d2ef8da5c3112d3a946981581f7adaf2c66185e24d50b000200a523841b6b83515669a77dfcad6451560184c42f07e07de99b45197731
-
Filesize
2KB
MD5ef4ebc34ec7dc5f28c595e5faa23ded2
SHA119e2bcb79418fff1b4628704ff021e8c3ed1ef2c
SHA2561e7ab3d962e4841505b9d595c08765b9b2a83249200b69ffb28f8e794ebd1dbc
SHA512fcb74310812f845191bcc6f88aa106012c5a817fadfae83b0ab1c90111b12359c2781e3f2684dad3bf872904d7aa5f6878f4505c727ce721f97ff9692e022db2
-
Filesize
6KB
MD5e75c0f5fdbbef9b4866b528724e25c36
SHA14cc48be7824afe8f9985879f878001f507f2e049
SHA2569c7912506e3a333cfe34437ce55ff0184279cc3e0b3baa39e3f6c51c4b3154ff
SHA512c1f78161312aa82da97b11ba2f00fc880302167e572053003b04ce02e36e7545a8acef4cb5ffc4607162816eeffeda75d14f27c16ffb015b7744c8600d115b85
-
Filesize
6KB
MD5b9393c8a7143104e79c04e2dfa842405
SHA1965cc1f719e3d8ff859f4a871ea66e1ab2d13e6a
SHA256aa2fc118b7cd062f954903d88f15f435fceb504562b4c8d2cce6048026c4457c
SHA512d846806e06969249f4bc14de24193088ce5def8dbb9a6c9325942dc2851645f89f90280bfaa17eb7c7375bf2ae47aaee85f989ea91c86d25caafe4f8ca997b94
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD53b4111a3a0b293725ebb522451ea9578
SHA1157f5fb54306138c85faeb8c009e2f9230d0feec
SHA256e7d4490b6ae9c0a63895cb5d64baa52fc2cd9f15e26a31fc3a5d55c306b1df40
SHA5122d31b11521dfb5834429376e20aeebe42571a4e4786a40c60237e1978e883d3c42e8b03409645e14619e45142e1bce69c65c488f893fb80f0aa2b1039e029b4d