d81f61983abd66ac6901646014151aca3cdfc90afb4a76b3578f137ba0649bc9

Analysis

max time kernel
146s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 05:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
Size

6.4MB
MD5

fb963a652ca701626826fbd35d7956f2
SHA1

2a242d47f5b962c33b47405f39b59af6a3e5906d
SHA256

d81f61983abd66ac6901646014151aca3cdfc90afb4a76b3578f137ba0649bc9
SHA512

5d0b1f90c29071154675c676a531ac329ba587a26626d836db0ea8afaeb1eee6b2dfa9ca52c695441b520856e1485ba393b9d6aaa7eaadebd585a4103e96db8b
SSDEEP

49152:XhiZ58fVirJRW209ombBGB93TkbX8SlZX5FrBtV+1PygXBL:458fViu0STXjrdGy6d

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\WINDOWS\QQ.zip	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\QQ\PPLive8256.exe	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
File created	C:\WINDOWS\QQ\PPLive8256.exe	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\QQ\WeekGame8256.exe	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
File created	C:\WINDOWS\QQ\WeekGame8256.exe	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
2952	msedge.exe
2952	msedge.exe
2516	identity_helper.exe
2516	identity_helper.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2952	3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe	82
PID 3248 wrote to memory of 2952	3248	fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe	82
PID 2952 wrote to memory of 2940	2952	msedge.exe	83
PID 2952 wrote to memory of 2940	2952	msedge.exe	83
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 4356	2952	msedge.exe	84
PID 2952 wrote to memory of 3052	2952	msedge.exe	85
PID 2952 wrote to memory of 3052	2952	msedge.exe	85
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86
PID 2952 wrote to memory of 1016	2952	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb963a652ca701626826fbd35d7956f2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.2cbb.info/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72da46f8,0x7ffe72da4708,0x7ffe72da4718
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14086377939027234063,17895249308276093302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5408 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e02c1fd16ac536a3b391e954d74cba56

SHA1
2b840d3871e1f34b316c0422faba09c279adfa36

SHA256
4ab06fc24a3158073518fb10fb46c290c4dbbd58b55365f47e12442a8fa2d986

SHA512
6a1bae2ce34867752963f2f201adf03e957f0eb1c355e185d416afb7d4c4cd9929933bbf6c58421a1bb612a694710583c4dd9a5d7aa2dd07f003af8ca40089e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d416e9359df71ad3f2a31a416de228ec

SHA1
beb92c2f33d774065be02636cae7b1168e7a4125

SHA256
acf2b0d8d4fedbe3a8306fb651e1e0d943fe253cbb319a06fac9903c7282bf1b

SHA512
f41356f566aae7580dcd6771a4fcbbfbe45b9a8abe9e59a7e2fc5d4e1eae0ef8b4d68785563568b931e8f4764c31c8d8b0b852c324812f358fec342b8adfdfa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eef27c7e9b5103e6fc40eb6a888e454c

SHA1
e95045e2887de8524d630130fddeaeb67766d33e

SHA256
cf9b94e2812c39c2dd9a5a17bee3ec524e0e3214d97c2570e799eee62d916af9

SHA512
e8b8db197317914763c821c32a4a94b6eda726c5f7a0af3a83a6c15047e90863e4268f6ac49b6c0f45af3c204a584b36760807812390834ea424641311e47f85

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\eAPI.fne

Filesize
332KB

MD5
3102c454a9543e58fe3ad5f783f5a690

SHA1
dc98fe9c47b1b4123ebe5e0132c0ba2d391570e9

SHA256
039670ca85824d4850e737a308aa8e628c83551a21711d549b17068fbdb2d9d9

SHA512
5b3218804054f0a3c24f3705c4902f333db0fc7b39aa81c2b71fefa0bc7d2a2ded14a13ab01ef3627889ff167ee7f565401ad0e5b5c9697d40f14f67228b9807

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\eCompress.fne

Filesize
160KB

MD5
71756e8ba6bec367176481c67e673f23

SHA1
91e40f02fdaa8dd36490336068b95e05a9a326ae

SHA256
29f3e0d132b07d9ea5c48f5ed54ee3ba1b0519e895ea9c0ef5ec518f4eb42d5b

SHA512
bd42728e7b751b12ddb945329de8d8b520918a8c3f1baecd3d9582b1f92ba3e6a8a9e17a93d827288460461bc8ce423bc48872fcf38cc1200e594dd84216967c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

Filesize
216KB

MD5
f91cfe6df71fbbbe56ddf70247ab9b49

SHA1
6d6e25569bca49c19f2a4b07675194a1bf055eb4

SHA256
7169863abd2e9a59ae706235224222754c44eea12a4304f6ac426ac4a89688a9

SHA512
841a0632b0bca43d590f72602a0161e04c77e1e881d5bd6d294edab4f9c5577bb8e46f15dd6a0c831e5774fa53e449397146d57b8575ea04506a64f3842490aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\iext2.fne

Filesize
480KB

MD5
338c9901d7a5cfeafd5b5a0c502fe96a

SHA1
0caf8271b2ebe5d3bd6fd66223e3a7a1e7d3dbd4

SHA256
6cf3add9e8297e2c6e0dd3ecdf7f8500c123c7779e5807a3c58de62aeb19156f

SHA512
45feb22b3fb505cb37ea0eff3494604f04a874ac6e8e2e9b2f2bf4d801f8d79a613967d23a4d69ffe0609d1cdba2c1292e5c8a3ec98df779db51b9be77a02a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
11696f334778bda9231aa6b72bbcdaf7

SHA1
09c604c90578fcbd4f596bdb013938a7523afbc8

SHA256
f1cd13f9ec76d87d4f5351ec5eee092fc530cde46bc71f74e0bd6c9fd7de9b9c

SHA512
071e8bd5ab8e4f12bbaf949c6979207257147eb8aa1d6ef7741ada64938721a15f8e78c6f74e74b642bdb5fde1e99b6059275c1e6b3d294f6e6c9071dd5535d1

Download Submit
memory/3248-14-0x0000000002AE0000-0x0000000002B24000-memory.dmp

Filesize
272KB

Download
memory/3248-20-0x0000000002AA0000-0x0000000002ACB000-memory.dmp

Filesize
172KB

Download
memory/3248-0-0x0000000000400000-0x000000000094B000-memory.dmp

Filesize
5.3MB

Download
memory/3248-76-0x0000000003260000-0x00000000032E8000-memory.dmp

Filesize
544KB

Download
memory/3248-86-0x0000000000400000-0x000000000094B000-memory.dmp

Filesize
5.3MB

Download
memory/3248-27-0x0000000002B30000-0x0000000002B93000-memory.dmp

Filesize
396KB

Download