Overview
overview
7Static
static
346d40a00f3...18.exe
windows7-x64
346d40a00f3...18.exe
windows10-2004-x64
3$APPDATA/I...er.lnk
windows7-x64
3$APPDATA/I...er.lnk
windows10-2004-x64
3$DESKTOP/I...er.lnk
windows7-x64
3$DESKTOP/I...er.lnk
windows10-2004-x64
3$DESKTOP/�...Ʒ.lnk
windows7-x64
3$DESKTOP/�...Ʒ.lnk
windows10-2004-x64
3$FAVORITES...��.lnk
windows7-x64
3$FAVORITES...��.lnk
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SMPROGRAM...er.lnk
windows7-x64
3$SMPROGRAM...er.lnk
windows10-2004-x64
3$SMPROGRAM...��.lnk
windows7-x64
3$SMPROGRAM...��.lnk
windows10-2004-x64
3$STARTMENU...er.lnk
windows7-x64
3$STARTMENU...er.lnk
windows10-2004-x64
3$STARTMENU...��.lnk
windows7-x64
3$STARTMENU...��.lnk
windows10-2004-x64
3$TEMP/remote.exe
windows7-x64
7$TEMP/remote.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$TEMP/sobar.exe
windows7-x64
3$TEMP/sobar.exe
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
46d40a00f37af8335bac8390ff7d0682_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46d40a00f37af8335bac8390ff7d0682_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$APPDATA/Internat Exp1orer.lnk
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$APPDATA/Internat Exp1orer.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$DESKTOP/Internat Exp1orer.lnk
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$DESKTOP/Internat Exp1orer.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$DESKTOP/ԱմƷ.lnk
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$DESKTOP/ԱմƷ.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$FAVORITES/Ա.lnk
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$FAVORITES/Ա.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$SMPROGRAMS/Internat Exp1orer.lnk
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$SMPROGRAMS/Internat Exp1orer.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$SMPROGRAMS/Ա.lnk
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
$SMPROGRAMS/Ա.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$STARTMENU/Internat Exp1orer.lnk
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
$STARTMENU/Internat Exp1orer.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$STARTMENU/Ա.lnk
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$STARTMENU/Ա.lnk
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$TEMP/remote.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
$TEMP/remote.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
$TEMP/sobar.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
$TEMP/sobar.exe
Resource
win10v2004-20240709-en
General
-
Target
$FAVORITES/Ա.lnk
-
Size
1KB
-
MD5
62d588bdb74e4e2e5d1689fa9272ce39
-
SHA1
9d0db515d8f65e57353381d707060f7343a74da7
-
SHA256
248402dd02a096f9721d61fe867fac5cacf4dc9001fa2aa6a50a59f7405606ef
-
SHA512
cbb47f7e4227177ad39a1c914e00e0ca13209fe0839d13819299ad203572b69026c541d71c5101e4cdddbcf7786c6adf339af3e4b0aab65cb188614f646a893e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2980 msedge.exe 2980 msedge.exe 5040 msedge.exe 5040 msedge.exe 4796 identity_helper.exe 4796 identity_helper.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe 5040 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 5040 876 cmd.exe 85 PID 876 wrote to memory of 5040 876 cmd.exe 85 PID 5040 wrote to memory of 4172 5040 msedge.exe 87 PID 5040 wrote to memory of 4172 5040 msedge.exe 87 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 4996 5040 msedge.exe 90 PID 5040 wrote to memory of 2980 5040 msedge.exe 91 PID 5040 wrote to memory of 2980 5040 msedge.exe 91 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92 PID 5040 wrote to memory of 3484 5040 msedge.exe 92
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$FAVORITES\Ա.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mai520.com/?taobao2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0x120,0x124,0x11c,0x128,0x7ffb094046f8,0x7ffb09404708,0x7ffb094047183⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:23⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:83⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:83⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:13⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:13⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:13⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:13⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:13⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:13⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:13⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:13⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4530928448015717302,16098520645809657697,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5492 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3600
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bafce9e4c53a0cb85310891b6b21791b
SHA15d70027cc137a7cbb38f5801b15fd97b05e89ee2
SHA25671fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00
SHA512c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c
-
Filesize
152B
MD5a499254d6b5d91f97eb7a86e5f8ca573
SHA103dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1
SHA256fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499
SHA512d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c
-
Filesize
6KB
MD545806d4f5ae5f8ee7d0d6f54c461ef91
SHA1f0e4c12fdcbd7f02404bcd74ac8173425d25a1ed
SHA25607097167d7f68f8274a202a1b707e50f6e13d7f1ddd3e30f4f412a247d50b418
SHA512f2b20656ad109d52b112af6f82010c7c5bf41c4d6d59f3a6439495e7de63504d2839913f4e22bde1b47d3f97077a369f8233da825e36a201f53669c9133e2b03
-
Filesize
6KB
MD513d6f5a838e91d45a450224b36505c8d
SHA1c1e8fb0b9348962225de4f5df5389d5fdf861212
SHA256377ccaa9f12578739fdd752b4b4651edc4644c52f3e0dd3ba1be89b940d63448
SHA5123e779b0ae0b11468feacf0074c394090c529c84694a60582a23abccf91b89d657a37fa21543766ac23de99547bff963a52fe63181fb3f42c4133f8adb6598b64
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD51c4c6b0af35fef43e4f9ee977c167567
SHA18e380dbf53d3bbfa9ddc8f335db336da6714337b
SHA256b4caef21b2eada359d8b1263e3e76819ad9c7752e802d595e803c8dcd247b890
SHA5124ac8c5c634e4b4be62e4cc49be9b2fc117f6eac0af0e3e3ec734a79700da2ff7202218b92b6a8cf1b3f2e9439b3e6fea114d6fca556a2cb6294b5b5ed5d309d9