82ea7cf27d035ca8a72bcb63b6890862713cd0103fae49ea6970a9671b2480b9

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe
Size

690KB
MD5

f0c02fc1904027b46dfbc135c4444745
SHA1

a0d2a0facc8d1308dbbfac5382331d9b3ec89d2a
SHA256

82ea7cf27d035ca8a72bcb63b6890862713cd0103fae49ea6970a9671b2480b9
SHA512

5bf2e954b64ddf73881b2371f534202d91425580a46292a338903b9c498c883a005e807b9d423ec80eeeff587ef277599b08c35f1719e686371a481e81fa41d3
SSDEEP

12288:sc0uk3fffvUTFTvpR3arb2r0JMD/ZqyE47ogJEogEf0pfqU3hQcM:li3fnvqRvpk+r2MUQoIvf0pyU+

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon = "C:\\Windows\\TEMP\\services.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msmmsgr = "C:\\Windows\\TEMP\\x\\services.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2540	reg.exe
4236	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
2488	msedge.exe
2488	msedge.exe
1940	identity_helper.exe
1940	identity_helper.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5108	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	82
PID 3028 wrote to memory of 5108	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	82
PID 3028 wrote to memory of 5108	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	82
PID 3028 wrote to memory of 224	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	83
PID 3028 wrote to memory of 224	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	83
PID 3028 wrote to memory of 224	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	83
PID 3028 wrote to memory of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84
PID 3028 wrote to memory of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84
PID 3028 wrote to memory of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84
PID 3028 wrote to memory of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84
PID 3028 wrote to memory of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84
PID 3028 wrote to memory of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84
PID 3028 wrote to memory of 1428	3028	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	84
PID 224 wrote to memory of 2540	224	cmd.exe	87
PID 224 wrote to memory of 2540	224	cmd.exe	87
PID 224 wrote to memory of 2540	224	cmd.exe	87
PID 5108 wrote to memory of 4236	5108	cmd.exe	88
PID 5108 wrote to memory of 4236	5108	cmd.exe	88
PID 5108 wrote to memory of 4236	5108	cmd.exe	88
PID 1428 wrote to memory of 2488	1428	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	93
PID 1428 wrote to memory of 2488	1428	f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe	93
PID 2488 wrote to memory of 3788	2488	msedge.exe	94
PID 2488 wrote to memory of 3788	2488	msedge.exe	94
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 2868	2488	msedge.exe	95
PID 2488 wrote to memory of 1560	2488	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2540
- C:\Users\Admin\AppData\Local\Temp\f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac03e46f8,0x7ffac03e4708,0x7ffac03e4718
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12986920463326674382,17430503612847973791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f0c02fc1904027b46dfbc135c4444745_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac03e46f8,0x7ffac03e4708,0x7ffac03e4718
      4⤵
      PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
092af4860228aa82cd437548b211f6b7

SHA1
bb8bf5706071b45d454d84e98a6f149e8907f378

SHA256
79d77e893da8e9d44d419ba2424797549cccaaf09c8c46fe38fe8fd3998c259c

SHA512
dd625ca1a7e6f7510aed4ac84cd071c1cb334367de41a3c50f384183b8df6c205506212da42db5583733f139c78c22998995829e65098458107d7e94a6fdc53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b4fda6f18d7663e95dd3e08f459dc4c6

SHA1
651e25fbecde0180618779bb236562ab00cc2c12

SHA256
424a2d3c6d331f8769db9a4765280c776cabdb846f6019210d3dab78b5207103

SHA512
48a868603a0c390c7bbe916e846999dc48a117144613bca55958c9aa66233ad578f85f94e00c488d1f829924eb676e9bbfb773f3b925c4c790af95d604628737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcbac02d8cc5f777d21ed116e5da94dd

SHA1
1d013ced0f8cb4a2c9ea14c89c75b5c27ce67465

SHA256
734057dca3abdb33b9d0d38901d61e4bde37fbfbe08256eb3e6a2743f9ab7b56

SHA512
299a7957d6684351d3530dcff34a19f9c30aedf73cdafa10d1e38ce742119fbec73ad15a7383d96dd3ff4e44e6b8150722ff588f684911feb8799e985c7a498e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3b729b61914d587de80c5b6fecd1152

SHA1
3349c9a57c8ba08885af482b52c0eca107d035c8

SHA256
3fce1582dd79a7e779eed432072c604035a283d417c244b8315e47c1426d970f

SHA512
91b15037adb8e9bc2ca7631e9ecb9c25ede7f8112ff4a9c138a343f678d460f387b79c0d26a6bdb9aee6b80f6c7f186f1dfd45ff59111186be6d4fbacca6925f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
8d29ab51e8e6b89ed231c581cb05d143

SHA1
38c0c33c6f4b34a54008cf8fbd2c31ed33954655

SHA256
d2834ba1aadd2985a0cdb099f5b2d3446be33c3a66dfcb4d8e1680a07cc8d0d0

SHA512
f9cd2bce250e280818e981c303e14c1fff4584ce3ebddb1962a0fbb566f33a13748040b16a8c462529fca29ed757eaaf55c36858ccfae191cc53816e08dce585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f6f3.TMP

Filesize
371B

MD5
50542f35a933645dab0acfdc83f309f4

SHA1
f3a650993fa6fbf26e31de0ba38a7ce77c354063

SHA256
21bbbb592a04ee81a879de51d19fd18c855d38e864258f04e77193eed64a734d

SHA512
188e65be522d8d29b9650b87ccadd39fe308e3e16baa9055c727dba215981e9f867b6689ca1c789c78e01473d165e9b2955f564f764584255d9125fe2f5db8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0538a0759088abde0266b82a60ad5f17

SHA1
ad8761dfcbbf36d18b10dec9a88ac0fffbfc29fa

SHA256
0365b92c4da6fb006b1ac717eb0330180943f10fad417cd05d1d0ee80f272e3a

SHA512
3715b3d65334be543314d5125f3c2cf6c684f2384f946d3fd53524c39ae001a5f2e46147bc832d762d52d7a85f6a9e17f33712538ff06f16445f93156ec5fd0d

Download Submit
memory/1428-1-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3028-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download