dbf774bca5740e8a8465217f9b2fa03463c263749395c43ab55a10bd1915d5eb

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe
Size

1.8MB
MD5

428c40c1b21a5ed517e7f167043493ba
SHA1

4aed0b0b17abab078e96e3fd28047b140d32bb1c
SHA256

dbf774bca5740e8a8465217f9b2fa03463c263749395c43ab55a10bd1915d5eb
SHA512

91be39eed110e919e7e01ef11152ba6ff852970a6d4c6ca43bbdf4dd3feadd4484b50aeca817035d550047b3e47ce3fc732adf4511197bc4f84d554b7de5b945
SSDEEP

49152:9uXkf/O3Brp5iIjRo88nQzD8dMnrmnNJp2QGz6C71XuHE:9uUO3tiIjRo/nDdKgfBGGG1t

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
4192	msedge.exe
4192	msedge.exe
2036	identity_helper.exe
2036	identity_helper.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1432	1104	428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe	86
PID 1104 wrote to memory of 1432	1104	428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe	86
PID 1104 wrote to memory of 1432	1104	428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe	86
PID 1432 wrote to memory of 4192	1432	WScript.exe	87
PID 1432 wrote to memory of 4192	1432	WScript.exe	87
PID 4192 wrote to memory of 1960	4192	msedge.exe	88
PID 4192 wrote to memory of 1960	4192	msedge.exe	88
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 5000	4192	msedge.exe	89
PID 4192 wrote to memory of 3468	4192	msedge.exe	90
PID 4192 wrote to memory of 3468	4192	msedge.exe	90
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91
PID 4192 wrote to memory of 4440	4192	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\428c40c1b21a5ed517e7f167043493ba_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\temp\tc.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.97dn.com/?tc
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff998cb46f8,0x7ff998cb4708,0x7ff998cb4718
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2788 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12217881121345191318,13257426820516900456,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6040 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.97wg.com/?tc
    3⤵
    PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff998cb46f8,0x7ff998cb4708,0x7ff998cb4718
      4⤵
      PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.wgxzb.net/?tc
    3⤵
    PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x44,0x108,0x7ff998cb46f8,0x7ff998cb4708,0x7ff998cb4718
      4⤵
      PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
04bb3e7a805062739fd9b2a78dd549b8

SHA1
c3935a8f5cda91d684ad591a1248bde8192a458c

SHA256
491e10c4f95a65f2f4c72dd1c66f93a719db41b3cfbae4ac812acf22a6857888

SHA512
d67be32cea95cf1f754be2649bd5a0e3297088f9dd2cbb307078da26399643bf678dd3a01cd97628e11d6380fa3a7be680923dfd4613733467c65d442571e470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7b8cc32e7f4636f8fcd6411581458660

SHA1
d96e766f6cd6dfe18fe1dc35fad58520ca7c98ad

SHA256
7719eafac643bf7d8b65d1b624aeaf1f6ed8078ae576ece361634d8b006019a0

SHA512
53eed46f386836bc0c804daed5da5d962ed189d075b556f53584c496731a5220493071dc276f899c77c4e31903f26ee94ca49d327df2033d8cb791f316e9e628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0e76984dbe1e3aeb051272b495fc07eb

SHA1
6f1160c3cf43f10eebaad196e3bf6a0e6dc9ad22

SHA256
879b2b20a67d92622e9cb75941b650d51d47a744d9904d8857bd4b2325f327d1

SHA512
6670fe67a8431d32d8192ef235baf0df36eff1e3b95981dd2aecf9dc765e60f9d68c92c03cf260cee37f2641763f6da797dababbe539373c6d3cbeb37e9703a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3ff7866746e8b95c400e6654df9e116

SHA1
abef147ab86dc546536b3c89da2315559b86b6f9

SHA256
8ff89ecdc0eda0c12b747e044414af8536378a67336660c220d0419830a74589

SHA512
4561b7c0edbb9b101df83606f03ecd3414c5ed074cc9f387a4bfe49d924ec9b0e6b55fe39f9a5da5559a133ab1b325cd325055d09913cd3024d65da1d2cf13a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
194ca3564059ec4dd5ef4e49400591d2

SHA1
ad9fe9b68c170cad8c6814e564fb387bc907c157

SHA256
446ce5208e9d2d563f5fa3f00f38aaaf8da7836669905cd5cc8f8a8a14940268

SHA512
a49991cfbb8ca7e685c03a065f30fe3e501f3fd8cb471e6a8c0ae64a999b5b6c48a25c84a9a79fe2738850fa442780f246d62010a84e65ea2c4f6bd96a216e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fef153572f74859ab30248deb543601f

SHA1
14c01131faf05ae71ae5f47179bf964fea52e207

SHA256
7fefa19fbaf5dca9b0c33376c914e4dd35684618fafd9f5f71deac62b7c44572

SHA512
b8f2c005b8a2a26df4380e4137552cb69eb8ed1d9a118df7aa5f1c2d62e754a675bf0fb0f219146d31af2abc27a3f2f664ed3d9f44062b273281fb23462828e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582ad4.TMP

Filesize
1KB

MD5
9363b270c90f12a6ecdf38db3c979ab6

SHA1
7d43960d646cd8d79de4c0b0fcedcfe750e4485e

SHA256
01096f16fea4c8fcbb17aaccd635ec686689999b3033a6bb2cf22f467f13bda9

SHA512
03463cf62847eae70c0701cd646a9f4f3b650c5d9016c1f15241648d09d4bce56fe49b6664af34860bb68a469eca0652553f6a8b2cd7f204c019843e41c4aca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ae35359a181264db7fbcb008962d175e

SHA1
f96ab31d635ad1f8e29acd324dd0f6e09fc8aac5

SHA256
797d9358462982ca137f5fb7b7264e315efdebd196866805a651a87abf47c83b

SHA512
620e1732705e369c638e99291cc1c719bc9724e28617870481bff881dcf9c233f562b20251c30a6ec701d6ea9e8010d521abbcc481799d186af5c8d112ff41b7

Download Submit
C:\Windows\temp\tc.vbs

Filesize
534B

MD5
76da5805a167c985041e3e4153f88939

SHA1
8c8e6732979e8da3bede00917d7c2022f0160ce4

SHA256
1494601d2a69cddc7c76336c026080a422892711438a532447b7e22eaa30cde4

SHA512
3a4b94c5d3f14fecbe360a5b9506bc25110ada3049834ab7dcb0c1fef83731d61e5d05e763623caa56319b053f79114a306fbba575ab106fc13bb939d42de7a1

Download Submit