Overview
overview
7Static
static
32d492b3bf2...18.exe
windows7-x64
72d492b3bf2...18.exe
windows10-2004-x64
7$PLUGINSDI...RL.dll
windows7-x64
3$PLUGINSDI...RL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
137s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BrandingURL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
General
-
Target
2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe
-
Size
489KB
-
MD5
2d492b3bf2516f20a3b3c188321451d7
-
SHA1
30f6207400abfa8e6dc2ffdb2a31ec73e5f13c87
-
SHA256
abf8bf380e330a2f4a5f6977a76eb6d394bc73a77471a93f563f4941d8fdc2a2
-
SHA512
a5bc36895e9a2d85d857bd294ab98782c66b8dfcc3e685315df7bced79f489eae13ca87c88ad36b3ffb4628eed54d9b1904006c314f87529943413eedf531880
-
SSDEEP
6144:je34R2ucFzh36dqXEVTrnCRZG/t7FTBqTzP7n7O7L6K2Bfo7p6:n2tzh36VVTGf0ZTsnz7O7L6ju7p6
Malware Config
Signatures
-
Loads dropped DLL 15 IoCs
pid Process 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 348 msedge.exe 348 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 2608 identity_helper.exe 2608 identity_helper.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe 932 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3516 wrote to memory of 932 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 86 PID 3516 wrote to memory of 932 3516 2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe 86 PID 932 wrote to memory of 4252 932 msedge.exe 87 PID 932 wrote to memory of 4252 932 msedge.exe 87 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 3472 932 msedge.exe 88 PID 932 wrote to memory of 348 932 msedge.exe 89 PID 932 wrote to memory of 348 932 msedge.exe 89 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90 PID 932 wrote to memory of 2804 932 msedge.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2d492b3bf2516f20a3b3c188321451d7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pf.toggle.com/s/2/8/28260-662782-adobe-flash-player-ie-aol.exe?iv=2012100410&t=17285006712⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc027346f8,0x7ffc02734708,0x7ffc027347183⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:23⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:83⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:13⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:13⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:13⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:13⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:83⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:13⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:13⤵PID:1824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:13⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:13⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:13⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:13⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12432054785806596060,9616725636734512347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5932 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3160
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
6KB
MD5ceb264edae79a92af1fd8e2105fd8dab
SHA1e76f94df10574436810e2c053ff56c5f3124a87e
SHA2563d3ad067f175db2479b076a44f6be8239b7956f54fd112878e2402ba40f496c5
SHA51257b0fd0c7d1a85e061d9fe36b525e00b13e23d392e252291393c1ab25345be78852766a757f20f1ca530e78345ac3cb6db0cee0208276d252a0c848bd9a421b9
-
Filesize
6KB
MD5ee7b4f9edcb1a09c64bf646bd40ab8a3
SHA1cfd549e67d484fbb3d97a7aa5c26b469a3a5be51
SHA256a506944af88b398ba488f1b29f4a57624844c47b9620e1ba2efbb121af54a87e
SHA5125ac205f1f63ec498029ef2facf2fbbd54e95443c414ccf5511689aabdac9e7f081ea98f40ab76baec3765e2c25bdb5372a29af224b55ba60a2aa3a0340cdc3fe
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD574b70f7ba194ffb97633b64c0f564e35
SHA1ff114ecb22ce5b40fb54fa836c964abcae7d0722
SHA256dd985395e93b4c42fdf3f0c2fa4bfe44a2ca7bbb6474a2b27e1caccdf95a9844
SHA512e221a4a1bce975ad747ffab87fb635086c1d2424584cbd3cf03c0654787586794c892712467f3af1fb0ae3af35953fee08ec33ffcc85a9bb5f203b6dd64987d2
-
Filesize
4KB
MD571c46b663baa92ad941388d082af97e7
SHA15a9fcce065366a526d75cc5ded9aade7cadd6421
SHA256bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
SHA5125965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
5KB
MD59384f4007c492d4fa040924f31c00166
SHA1aba37faef30d7c445584c688a0b5638f5db31c7b
SHA25660a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA51268f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
17KB
MD509caf01bc8d88eeb733abc161acff659
SHA1b8c2126d641f88628c632dd2259686da3776a6da
SHA2563555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
SHA512ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
415B
MD5d8db011362860645c5f36e6fcfaa631f
SHA1ad356de5e5f6886418916b2bcd3307e3829cc984
SHA25642ab22319e36a1ccaacdd052e31abc79b92b169e1474d6bf2bd5882e0f362796
SHA512064c2d268d61211be4f8af34d15b01919cc6001cb68549636836c8ce4ea59a77f94a463496249ff4a03c551cc2abe66f12faad9d734bda8cfbc17a2c50ce37fe
-
Filesize
1KB
MD585f9ce04aacb0a4a2a3774ef6b286ebb
SHA196933a44b53cd8b49b87494fdeb81e41d4d5e0d4
SHA25661b231ca6791c7f66c7a5b29cbf9b24b0270beba1b0c6e7d35b6435e0ae857d8
SHA51225824607931d790ad2e1e105de0a9302d4adc15d2264d89c485c084f9e8d6938b3aecfcac65c44eb8220ddce643c39cd86a2cbeb85958fe1ff7c36de1c887812
-
Filesize
1KB
MD5cf576e460cd55071a1227b1384b05946
SHA17e6f2a9bfa3183baf57324a66d1afed7e2dbd648
SHA2564122ebee1c1ab407df83a75a7c0ebc5023f02e2013fac0dcaf6adef5667d352a
SHA5120ef666ca83a6ca52808f8df977003f5c3cba6e4831e532b510293c3b147b8402f2f4f919f2e663d7e6d7587652f05340e67ddd84aa439ce4a6c66fd007f5d5bb
-
Filesize
940B
MD5b66e7fdd84c4e2db3580a9602ae8ddc7
SHA1e037728865af4babe5cf45e227ba5c89b644f963
SHA25601378dfc6a99d4341a56d597ab584eb13d46629c73c6cec1e4f02ff449f5823a
SHA512994d65cb43e3b02b00cfbf3050307f9462ef6011cd97dc660defec97de6a22846ca91ebe3df9f71c5735f105eaf7686988f6ec761fde131816aaa4aaf883bcb2