Overview
overview
7Static
static
7JaffaCakes...09.exe
windows7-x64
7JaffaCakes...09.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
5$PLUGINSDI...oc.dll
windows10-2004-x64
5$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/Toolbar.exe
windows7-x64
7$TEMP/Toolbar.exe
windows10-2004-x64
7$TEMP/sqlite3.exe
windows7-x64
1$TEMP/sqlite3.exe
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 19:34
Behavioral task
behavioral1
Sample
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$TEMP/Toolbar.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$TEMP/Toolbar.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$TEMP/sqlite3.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$TEMP/sqlite3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
-
Size
748KB
-
MD5
d105c88fe2e14f3e28a115b6cbadee09
-
SHA1
aa0475837db0a5e1fd6ec20f89c2f40e0c664a0b
-
SHA256
17612a5d50b77aaf43c282c8fbc67254f93f20a9b1290f16449a088541964116
-
SHA512
0427b96c57f69dd40c3c87f63ff56cb02b9a6a65c303cd3e6f81abbbf6b2f45b2acbe2248a6e77b08bffc6f2ed55ab2c3f2b1ce8cf8dc270cd5309d14dcb595d
-
SSDEEP
12288:y6gcS2d2g7W1B2dNwnWTzBlqd+qUkQxv6ZUAybDK2VPW1jkxB4fc8vy4h26:y6317Mg+yod+ECvIgJ2gd860
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3508 Toolbar.exe 2940 GLBF3F5.tmp -
Loads dropped DLL 18 IoCs
pid Process 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 2940 GLBF3F5.tmp 2940 GLBF3F5.tmp 2940 GLBF3F5.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Toolbar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLBF3F5.tmp -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\SearchScopes JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\DisplayName = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{C47F73BF-F3C5-40AF-B346-A80D1567802E}" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E} JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E} JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{C47F73BF-F3C5-40AF-B346-A80D1567802E}" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C47F73BF-F3C5-40AF-B346-A80D1567802E}\URL = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://downloads.phpnuke.org/en/index.php?rvs=google" JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 548 msedge.exe 548 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 2268 identity_helper.exe 2268 identity_helper.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2940 GLBF3F5.tmp 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 2940 GLBF3F5.tmp 2940 GLBF3F5.tmp 2940 GLBF3F5.tmp -
Suspicious use of SendNotifyMessage 28 IoCs
pid Process 2940 GLBF3F5.tmp 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 3120 msedge.exe 2940 GLBF3F5.tmp 2940 GLBF3F5.tmp 2940 GLBF3F5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 636 wrote to memory of 3120 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 85 PID 636 wrote to memory of 3120 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 85 PID 636 wrote to memory of 3508 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 86 PID 636 wrote to memory of 3508 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 86 PID 636 wrote to memory of 3508 636 JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe 86 PID 3120 wrote to memory of 1580 3120 msedge.exe 87 PID 3120 wrote to memory of 1580 3120 msedge.exe 87 PID 3508 wrote to memory of 2940 3508 Toolbar.exe 88 PID 3508 wrote to memory of 2940 3508 Toolbar.exe 88 PID 3508 wrote to memory of 2940 3508 Toolbar.exe 88 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 1132 3120 msedge.exe 89 PID 3120 wrote to memory of 548 3120 msedge.exe 90 PID 3120 wrote to memory of 548 3120 msedge.exe 90 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91 PID 3120 wrote to memory of 2040 3120 msedge.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pf.toggle.com/s/3/6/36532-91420-gom-player.exe2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffc5e8246f8,0x7ffc5e824708,0x7ffc5e8247183⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:23⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:83⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:13⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:13⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:13⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:13⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:83⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:13⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:13⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:13⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:13⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:13⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:13⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3482290585396356740,14209800581799801118,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832
-
-
-
C:\Users\Admin\AppData\Local\Temp\Toolbar.exe"C:\Users\Admin\AppData\Local\Temp\Toolbar.exe" /s -silent -DefaultSearch=FALSE -StartPage=FALSE2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmpC:\Users\Admin\AppData\Local\Temp\GLBF3F5.tmp /s -silent -DefaultSearch=FALSE -StartPage=FALSE 4736 C:\Users\Admin\AppData\Local\Temp\Toolbar.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2940
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3952
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD58adb252cfa4ea9b391e420d87eafbd0f
SHA1a82f7abaddec5dce9dcee48a9bcd55fdafc360c0
SHA256085818b03d375fd6d687f8662602ba56000d646271b6b3a82a719965dce5d72d
SHA512d8d9f822bb9847f4d725dd50d1ff5e9898a1d749f5670cb604f2512eadd8ea3619f05ee9ee666a5c72bfbdd0935ac6cd6db0135052b2048f2f49364dd0bd4631
-
Filesize
6KB
MD515610396730687db1f9463bfb07360e7
SHA11b2147f8910ea8726e6cd6435585b36cf8070a1e
SHA256613f019a3dc2a532b07e15278b183e908207074bd1a707907597184e975ce551
SHA5124a280e7aca6d2306e19e275a4f0141766b708594f642b86e8181885355dc255a64bde04c25f571a523ea8bca211da54d3cffb4f676994feeda55cd0353a50e29
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56e04f7eab06e30030fbcc02b18a930c3
SHA1ecf064fcb803ca8da085c29d8833040e438caeeb
SHA25656ff7f479dea27c648025375074295f08ea1ff9dc2c6e221c5790b7bb7d78090
SHA51209a6d662f526821d8621a8b06024f406be0f8549f1119c543f00ede4d072b68b247e8fba883b3e6cadd2d6ba39c83cfdb26a63961c98a1c49f97b19035b2cfec
-
Filesize
70KB
MD5793a2c91c1b687b58809d7bb079457a7
SHA129363e8d0591accb9dc84512c6e634e1e17c591e
SHA256fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4
SHA512a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b
-
Filesize
161KB
MD58c97d8bb1470c6498e47b12c5a03ce39
SHA115d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA256a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
SHA5127ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f
-
Filesize
12KB
MD5484cb68472473a1a84ff07996bb8c1f6
SHA1bce9d810f2558e73854e7c8e05f122b002558e9a
SHA25615bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
SHA5125f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47
-
Filesize
198KB
MD55a82a45f2e0aaf617c8d511d43100fe1
SHA1515aa5b88b8c129046706d8542bee3699f62968c
SHA2564761b338dc54c9a3adec6a79024029d5041b75f4f9bb30baf98b5d3ff34d7614
SHA5124811406accf89eac961a349b78449185e894ae4c89a7c380da1e67005c953ef782e57d2370fdc09027bb36586ad57d2476888b33b5913ca74142c72b1c17051a
-
Filesize
31KB
MD583cd62eab980e3d64c131799608c8371
SHA15b57a6842a154997e31fab573c5754b358f5dd1c
SHA256a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
SHA51291cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
5KB
MD59384f4007c492d4fa040924f31c00166
SHA1aba37faef30d7c445584c688a0b5638f5db31c7b
SHA25660a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA51268f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
17KB
MD509caf01bc8d88eeb733abc161acff659
SHA1b8c2126d641f88628c632dd2259686da3776a6da
SHA2563555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
SHA512ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
-
Filesize
408B
MD57dfae2258718e7cbdf445254c01893b1
SHA1e7828b7df42564239b8e60203f8bc2031438f850
SHA256fdad2b510be9a153307a39289f9c1d142cbd8268fe5870bc1fedf543f2005158
SHA512d3fcef4526279e634909c0e55002756f640e05d6123e08d53ba8ba21f7116d1011e7c094d4b8bf168358d188c1b82afc21b4626fbc13cb8d1a2fbf21571bc716
-
Filesize
1KB
MD52e8c995f1214eb49ff6554022d10110a
SHA15eba54723c28a8966f8e9f36254c10feaf87c43b
SHA2562acd68059bb28a7c3808176bddc46a2ab551ff080984ea25689afd80d9a4bf83
SHA512b44f5628eea5ec4e312842069dbd905b7dc3b82f01fa756b157ca319b108e706990b644ffefd7f123e9dea44625b85375d6fdae045ab96df4ff66608b4bf5ce4
-
Filesize
1KB
MD5cca1bdf11fc43a25933969cb604f7a73
SHA185b074839b4a73ddb407a9bc03aa4a5ab6788f2a
SHA256d8feb9da6aebd7b89a96b6cd72c09939965c5cce90253f1ab709f6d61cd9dac2
SHA512a0c65d84a0f8aec4c459559e171dca4e4a793aa48a9416a5ea7c3d596ed086ef8501dbe12bec972fc247cd7ce1ff1332519abec65049c5798c84ac01fa76c110
-
Filesize
1KB
MD54f9ce7aab55602e0c259ee72bc64ade9
SHA1eabd7cc46a62e0e6018b88d79582b2907d6cbc4d
SHA256b14f54e7f247285bce27f9575b652f55022f937148f1e27c9f3186df5f6058b1
SHA5127c1e0199052eb69a6533882c1f3d14010c374e5e91d43ea2fd6bb9d1b83eaa6d7730524a7b21185bed38fb4f6f4b98e4cedbe1b0c266cd39cf0292715c8da551
-
Filesize
1KB
MD5306f288588b1550eac1d1adec12e96c4
SHA1c18b667ecdba0b0777621a4c0d8185268872ca30
SHA2560a4b338064a08a2bcd13992e754856ea9044a6880fd673e725cddd3744ab787b
SHA51262d970f811ba93056e83f23eae1220c89b8b95548d3855491c0c6badf7e5e84553c2144eb3c8f75ced038869d0bfeebfc7ce9f14e2bfafdf3bfb8cf4ecd96c0d