modiloader | a97838413b9b5bba3713cf4b5a2078983c3d641ce6e74cf94ce2f0f16d30a2a8

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2025 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe
Size

1.4MB
MD5

0b539d23564f43f77e674f426f76b42a
SHA1

c9c23bc2d4f2272a85fc1dc21b643a54f5c963af
SHA256

a97838413b9b5bba3713cf4b5a2078983c3d641ce6e74cf94ce2f0f16d30a2a8
SHA512

bee0d9c8d156a1167238a69391395e5add7b70d4263ce3f79de127744400da5fdf3eff858124504fbcc36bd6de4ba4fc0a4207d75895bf128e5b8193e66f3bd0
SSDEEP

24576:Yrz+Ka7klyytod7ybjePYpE640xUJSNdxWhfjaklDRfIcu5Ic+EXp0I/UkTTiKLm:Yf+mUpd+by6E6nPxE/lD5IcuWnqpgk3m

Score

10^/10

modiloader discovery trojan vmprotect

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader Second Stage 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c9b-6.dat	modiloader_stage2
behavioral2/memory/4828-13-0x0000000000400000-0x00000000004BF000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe

Executes dropped EXE 2 IoCs

pid	Process
4828	01.exe
3940	02.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023c9c-16.dat	vmprotect
behavioral2/memory/3940-24-0x0000000000400000-0x0000000000615000-memory.dmp	vmprotect
behavioral2/memory/3940-66-0x0000000000400000-0x0000000000615000-memory.dmp	vmprotect
behavioral2/memory/3940-81-0x0000000000400000-0x0000000000615000-memory.dmp	vmprotect

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\2010.txt	01.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\WINDOWS\11\01.exe	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe
File opened for modification	C:\WINDOWS\11\01.exe	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe
File created	C:\WINDOWS\11\02.exe	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe
File opened for modification	C:\WINDOWS\11\02.exe	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe
File opened for modification	C:\WINDOWS\11	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3940	02.exe
3940	02.exe
3940	02.exe
3940	02.exe
4764	msedge.exe
4764	msedge.exe
1196	msedge.exe
1196	msedge.exe
3252	identity_helper.exe
3252	identity_helper.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3940	02.exe
3940	02.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4828	2172	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe	82
PID 2172 wrote to memory of 4828	2172	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe	82
PID 2172 wrote to memory of 4828	2172	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe	82
PID 4828 wrote to memory of 3472	4828	01.exe	83
PID 4828 wrote to memory of 3472	4828	01.exe	83
PID 2172 wrote to memory of 3940	2172	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe	84
PID 2172 wrote to memory of 3940	2172	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe	84
PID 2172 wrote to memory of 3940	2172	JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe	84
PID 3940 wrote to memory of 1196	3940	02.exe	85
PID 3940 wrote to memory of 1196	3940	02.exe	85
PID 1196 wrote to memory of 1020	1196	msedge.exe	86
PID 1196 wrote to memory of 1020	1196	msedge.exe	86
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 1488	1196	msedge.exe	87
PID 1196 wrote to memory of 4764	1196	msedge.exe	88
PID 1196 wrote to memory of 4764	1196	msedge.exe	88
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89
PID 1196 wrote to memory of 1604	1196	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b539d23564f43f77e674f426f76b42a.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172
- C:\WINDOWS\11\01.exe
  "C:\WINDOWS\11\01.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\program files\internet explorer\IEXPLORE.EXE
    "C:\program files\internet explorer\IEXPLORE.EXE"
    3⤵
    PID:3472
- C:\WINDOWS\11\02.exe
  "C:\WINDOWS\11\02.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dnfnani.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa8b3746f8,0x7ffa8b374708,0x7ffa8b374718
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
      4⤵
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12515609271028967046,4548000067870344119,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5392 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf8012389d60f48f9a5d490a5e098b76

SHA1
f83feea8ff3fbcaf82d471e4c9baec3c083a7029

SHA256
2f1b87dc26d22de4c8b1712432b2b00f56a7d900db67cc0714b6e60860a7690a

SHA512
c32db9db83037f9978f94120ef8657a1d4307e3c71d3a5defcf9c7b7a29d785e48aa8ba7d9643a0b87e664a5f4e74218c8391d9cf91d5372ca47f704fbb07ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0808f3bce4880a9b83de9ca062d8d2d

SHA1
2ea6016c70018a7a22fd5cd3e094f07e67fb9f49

SHA256
e9cfd60e035a59ba8a59347e0a87e79093b7735dfd548d4868c10fd63aaacc6a

SHA512
a8f304eceaf77bf88b858b207207f521675bde819a99491db21c9dd1b168f859ca87f9478da4ac73f34e653274b92324351fadde3b79b97efff626eeb16b3f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ca683d666298f32de1e571679321241

SHA1
96a673d2dccafa6bca323caa2297fc964b0dce7f

SHA256
2e1ad2015bbe0b113674f195ccffe7af83ea121e2f1af2f996ceebe506816e1c

SHA512
81ef15001226897522c4ef2f5544ac74c48d32aace7a6fd60f67c5923e76c7fb161cdc9c27d422d580dd2d7bdd62696f2092220a266ebddc72d824f4c752e977

Download Submit
C:\Windows\11\01.exe

Filesize
685KB

MD5
dd22522bfbde59bb606df42589ee4998

SHA1
29f5c7125e86ee93199cfb79df8264317ef1448d

SHA256
f6d9dfbf7b78da983e9ca7eb7f812d021ef0d6bff15e129dea18bba6e965e114

SHA512
771e5d787cc43efbee7d3479091daef7a79487e88dde86a1d9e4d0fbdc9366554c4281783ce85cd2d46950dcff4637318e34b6c45f8943547aa91bf927604d4f

Download Submit
C:\Windows\11\02.exe

Filesize
1.1MB

MD5
773a0f44b141b140584cc4373a60b3be

SHA1
eb86b8019c3649c8c6e36a9558c9d443c8e38d6f

SHA256
defb1dc99f7982f9c0b5d621ad995d0739cef0826d3b25e27f3077c01a4b9ddf

SHA512
6043604cd2c2edb23f16c0ec4d4a0a4386d8471b693adbe275741aab7d29e38964925d24d1333537182b7bb1581d1cf489bb70aa8e42600e7cbbb5a0815b7041

Download Submit
memory/3940-24-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/3940-66-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/3940-81-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/4828-13-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/4828-11-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download