6eebdb6aae883ece7db378cb3afb66af5e5ffb6c913ec6597ddc22da0a92b980

Analysis

max time kernel
146s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
Size

3.1MB
MD5

17d4ed5b20a78890c775a77f8e4e32b4
SHA1

4413ebf546907c9c540dde3f73a6146f96f4cca4
SHA256

6eebdb6aae883ece7db378cb3afb66af5e5ffb6c913ec6597ddc22da0a92b980
SHA512

e651cca1e00e08eed38ddf513b62ae044b0ab2e0a6d5dd79ebad9c687eead3f0ca78b83510bb561b2c443985a3cb75c4a9a0098226067023b7814340b7675c44
SSDEEP

98304:CMQEzTuc//////qdOgzZFvZem2JjUEGIc7ICyu:J+He3gPl

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00030000000006dd-17.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4980	1.exe
2348	1.exe

Loads dropped DLL 5 IoCs

pid	Process
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\SkinH_EL.dll	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\imedllhost09.ime	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\imedllhost09.ime	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 2348	4980	1.exe	83

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00030000000006dd-17.dat	upx
behavioral2/memory/3560-20-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3560-118-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\1.exe	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3476	2348	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Internet Explorer\IESettingSync	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
3640	msedge.exe
3640	msedge.exe
2348	1.exe
2348	1.exe
1540	identity_helper.exe
1540	identity_helper.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2348	1.exe
Token: SeIncBasePriorityPrivilege	2348	1.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
2348	1.exe
2348	1.exe
2348	1.exe
2348	1.exe
3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 4980	3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe	82
PID 3560 wrote to memory of 4980	3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe	82
PID 3560 wrote to memory of 4980	3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe	82
PID 4980 wrote to memory of 2348	4980	1.exe	83
PID 4980 wrote to memory of 2348	4980	1.exe	83
PID 4980 wrote to memory of 2348	4980	1.exe	83
PID 4980 wrote to memory of 2348	4980	1.exe	83
PID 4980 wrote to memory of 2348	4980	1.exe	83
PID 3560 wrote to memory of 3640	3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe	84
PID 3560 wrote to memory of 3640	3560	17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe	84
PID 3640 wrote to memory of 5036	3640	msedge.exe	85
PID 3640 wrote to memory of 5036	3640	msedge.exe	85
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4596	3640	msedge.exe	86
PID 3640 wrote to memory of 4472	3640	msedge.exe	87
PID 3640 wrote to memory of 4472	3640	msedge.exe	87
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88
PID 3640 wrote to memory of 4796	3640	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17d4ed5b20a78890c775a77f8e4e32b4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560
- C:\WINDOWS\1.exe
  C:/WINDOWS/1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\WINDOWS\1.exe
    C:\WINDOWS\1.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1808
      4⤵
      Program crash
      PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mingrenwg.com/?BT
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb96746f8,0x7ffcb9674708,0x7ffcb9674718
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7556859535904661211,12264070102901871557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3496 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2348 -ip 2348
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
08322d6f08464d5053f5152a2c21c335

SHA1
b2e46b6078124a0ced4219d06fd4f5371b27196b

SHA256
9ab538f75722c5bb537209fdd0c5a970debe128de1d72b131ca4e246432f9ffd

SHA512
14ae57d0698bda18e318c8583351674150f384da603001ce5f37ca94abd27a2d177ed0a38b0fbed5a260638373e6efd14f037a67144b0a871d8d7bd40ffc0bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ee34a7bb50273ec24b6b27c65a9352d

SHA1
2b8329d4b9d8735fac8fe15896618a011207abd7

SHA256
dfe8802984349ea11daf863b480de071880dfc96364b2c5f37e5eaf0ad52699f

SHA512
5400455dfebc7dd952834c3a45df1eb252c2e4ea93e38d548fc73a0336b8b3062990ade80e3a1df06855b26d7d8c8de62d43bc024fc27027a1dad71b024c950f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bddbc335872d46e1d422de2bc87a473b

SHA1
14580e0c1dd7c35cbcf8a85d2b81c1d9e1c60af8

SHA256
fb9be13b2d38672c05f70fde93ec4cf39406630dddfd9fbd03c1e5ba06d9a863

SHA512
630f6fae0fcb6aa31f19cdd08deaf8a44b9373a8f9d1d03b150fafa2bc8e7aa0b28983ddbbb32f23cea748f1eb647580fe78f072a8931b08a48668c9a8632c7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\951G8FD5\httpErrorPagesScripts[1]

Filesize
11KB

MD5
9234071287e637f85d721463c488704c

SHA1
cca09b1e0fba38ba29d3972ed8dcecefdef8c152

SHA256
65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

SHA512
87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GENTSNHI\errorPageStrings[1]

Filesize
4KB

MD5
d65ec06f21c379c87040b83cc1abac6b

SHA1
208d0a0bb775661758394be7e4afb18357e46c8b

SHA256
a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

SHA512
8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

Download Submit
C:\Users\Admin\AppData\Local\Temp\imedllhost09.dll

Filesize
52KB

MD5
b60da4e2e5aceba3ce3d87ee2cd872ee

SHA1
9bbdbf1f3ce2c000a86e0473da756a4b1031db41

SHA256
b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453

SHA512
664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874

Download Submit
C:\Windows\1.exe

Filesize
1.3MB

MD5
1bdfebc1a4c880e24f5ec4d9e93b82a7

SHA1
077de396089425f6a97eefc5fad61c03ef11767a

SHA256
12ebe3a9b41d47fca32ecb7cc4f0da722d34d838ab73eb4823b57dfebd911f97

SHA512
d1c012a24ebecc02081aa0b46a3fe21719ff18c089bdec916d756d8dcaca44b143f3e0c9db92bdfc8b29508cda45efda69a5b1dc11093adb8aea58c50d401f21

Download Submit
C:\Windows\SysWOW64\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/2348-102-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/2348-14-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/2348-5-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/2348-12-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/2348-10-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/2348-11-0x00000000006A0000-0x00000000006A3000-memory.dmp

Filesize
12KB

Download
memory/2348-8-0x0000000000400000-0x000000000060A000-memory.dmp

Filesize
2.0MB

Download
memory/3560-0-0x0000000000DB0000-0x0000000000DB3000-memory.dmp

Filesize
12KB

Download
memory/3560-118-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3560-40-0x0000000005030000-0x000000000503E000-memory.dmp

Filesize
56KB

Download
memory/3560-20-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4980-9-0x0000000010000000-0x0000000010153000-memory.dmp

Filesize
1.3MB

Download