a28fc88565249685a0af6816a7b8a5f779503dca63fb42be756d97aaeeed53a4

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
Size

887KB
MD5

2cc1bb2cf127321ee5f1263c04477d71
SHA1

013a4e4b9f80d1e2d4a5c1e44143bd5f2c44e8b9
SHA256

a28fc88565249685a0af6816a7b8a5f779503dca63fb42be756d97aaeeed53a4
SHA512

a63050691f77cf1cd8993bc85af6689804c0e4ba47adb8d1832cfd6987b4204b9ee4ac05d07b201afc7ef1cfc8fe5b7302f3f9ede7e6cbeff4d84211cb5c3a38
SSDEEP

24576:FnfBRf3JbwQxsiK3eiQwoM+96u7ojVCwvztuMGZW:FnZRfVle3KwoRZ7e8wb8dZW

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\Q:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\X:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\L:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\N:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\A:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\B:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\G:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\H:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\K:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\V:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\Z:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\E:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\M:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\O:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\R:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\S:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\Y:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\I:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\P:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\T:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\U:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
File opened (read-only)	\??\W:	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
93	api.ipify.org
91	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\msew_02s.css	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{7C0767E3-97FF-48FF-BBDA-A570046E0D80}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
2448	msedge.exe
2448	msedge.exe
5012	msedge.exe
5012	msedge.exe
1788	msedge.exe
1788	msedge.exe
720	identity_helper.exe
720	identity_helper.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2328	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2328	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2328	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 5012	2328	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe	86
PID 2328 wrote to memory of 5012	2328	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe	86
PID 5012 wrote to memory of 3132	5012	msedge.exe	87
PID 5012 wrote to memory of 3132	5012	msedge.exe	87
PID 2328 wrote to memory of 3540	2328	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe	88
PID 2328 wrote to memory of 3540	2328	2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe	88
PID 3540 wrote to memory of 704	3540	msedge.exe	89
PID 3540 wrote to memory of 704	3540	msedge.exe	89
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 2208	5012	msedge.exe	90
PID 5012 wrote to memory of 4824	5012	msedge.exe	91
PID 5012 wrote to memory of 4824	5012	msedge.exe	91
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92
PID 3540 wrote to memory of 3708	3540	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2cc1bb2cf127321ee5f1263c04477d71_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pekalongan-community.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef0f046f8,0x7ffef0f04708,0x7ffef0f04718
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3428 /prefetch:8
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12512008838987830366,8623067562039393314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://adf.ly/EE32e
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef0f046f8,0x7ffef0f04708,0x7ffef0f04718
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16856826176704698307,15290079804587316221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16856826176704698307,15290079804587316221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pekalongan-community.com/
  2⤵
  PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef0f046f8,0x7ffef0f04708,0x7ffef0f04718
    3⤵
    PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
b7d6e19d9025e28745b3a5d4e6f3af8e

SHA1
b127743e537e5e30174a610b10575a32b1cec94c

SHA256
100b3312e3257f5e54dbe5ad1d08a27de781d3d7a66a94dbd3ecc78c611ad0be

SHA512
eaa4d8545d7d38a36d89f3940a2e39c9ff265f8a33bbfb91d67130dbb3850701a940dd1b78a824be0632eb13768529e9da5652242fad7fec20d06f5861c1c67d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e3c48c0b8b2a67d83710489fc23d1ba8

SHA1
69d13dfdc6ff56096531f29a8e4cfd90af594c82

SHA256
5e088eb0b59beaa8bece68317f2c780eb6d6419a1af3967196fea699444b4979

SHA512
fb0fa3f75da844a650800eb876c1eb531f22bfef87541e9769a91b93729636d776027aaa65b307d2ca5155049f427bad14e0d8b889d51abb895572d61aec656d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ba33cb0df1bbabc8714c9e7c54444b24

SHA1
631fdcf7f4a9e7690453215d750218ec852c1588

SHA256
934ef9a592cc1dff41b980468d306f504458896343c78ce2557ff72b0af4af7d

SHA512
c526546bf804f670fafc153dd460f3af91df4a18491a9b3c6126052ec0f8b27b2adfee59f1eb2c25f9a86f4c9cd9391b12548878ab5f035a72b00ccfe3b96d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
974876641e52e5bceb3607590f8e6bba

SHA1
a6cae29755fbd470bef4d34e40cfc523bed43105

SHA256
74aef949959e1ba3917a300bee0e458ce43bc01c8976ae09cb8f678da9e66aed

SHA512
0aead17e63ba90e9ecf637a2a26516f9bd16ae46fb64af500e04871dbda3cbc344989866f97c91c561b7d68f6b055ea0faf1c3a09d5293f6f529b18586521411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
713bf73cef703b319e2cd4fda484d11b

SHA1
0d4c5146f9a3d05f87ec4cceca0b820cdf90f6be

SHA256
9811b6763bc0a6b016c717a46e6f8be7b72c7eb5581fe812dc80c3fee6d36c07

SHA512
f3e3ce97fe1e3e9c1c36042d86b0c660aff1b4de331e474dff79c4275cee43f1ce796ade77889164be55f5599b40ca22fe264c27ba60316f2b622ed4af168470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
147fb2706ccd910c76ff690893b7a105

SHA1
3c0c0c7f2c8c74c02caa7f2106707311720384ba

SHA256
88ff4c27cbba9529107c6796b0342a12463c7d13d42808bc3717e6b3f1bdeea1

SHA512
da17b7d49124e5ed269d0a4e772518aabb315021ebed7efc776f33652616c12918b6d2e212fbf2715d66f963def5f219c5b44f26c3be7309878c33e58a113d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
memory/2328-0-0x0000000000400000-0x00000000004E3F80-memory.dmp

Filesize
911KB

Download
memory/2328-195-0x0000000000400000-0x00000000004E3F80-memory.dmp

Filesize
911KB

Download
memory/2328-226-0x0000000000400000-0x00000000004E3F80-memory.dmp

Filesize
911KB

Download