Overview
overview
7Static
static
3JaffaCakes...1e.exe
windows7-x64
7JaffaCakes...1e.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...nz.dll
windows7-x64
3$PLUGINSDI...nz.dll
windows10-2004-x64
3Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/linker.dll
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/linker.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsisunz.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe
-
Size
499KB
-
MD5
40beaae473968f6fd4c6ff333f1ced1e
-
SHA1
b103a295537a209192cc2895f4ff30cda98cfb2f
-
SHA256
c175074bdf29a0e9a3aa7bbd59726e7e475467e3e1f747340dfb99ed5339322e
-
SHA512
49747c78b3f27ae6f70e128f719701e1a1200f9b7f050935d9841330d5aa22fe10e72a116099e75143e8d41a5103b97bd45909cfc00a208ad613f2ac4a9b3fd4
-
SSDEEP
6144:ke34R2dsf2zh36dqXEV2rnCUZG/t7FTBqTzP7n7O7L6K2Bfo7pY:K2mOzh36VV2GC0ZTsnz7O7L6ju7pY
Malware Config
Signatures
-
Loads dropped DLL 14 IoCs
pid Process 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1252 msedge.exe 1252 msedge.exe 2808 msedge.exe 2808 msedge.exe 4132 identity_helper.exe 4132 identity_helper.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe 2808 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 2808 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 84 PID 3196 wrote to memory of 2808 3196 JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe 84 PID 2808 wrote to memory of 2868 2808 msedge.exe 85 PID 2808 wrote to memory of 2868 2808 msedge.exe 85 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 924 2808 msedge.exe 86 PID 2808 wrote to memory of 1252 2808 msedge.exe 87 PID 2808 wrote to memory of 1252 2808 msedge.exe 87 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88 PID 2808 wrote to memory of 4064 2808 msedge.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40beaae473968f6fd4c6ff333f1ced1e.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pf.toggle.com/s/3/9/39820-82307-driver-c-media-cmi-8738-pci-audio.zip?t=17380307732⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87d4646f8,0x7ff87d464708,0x7ff87d4647183⤵PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:23⤵PID:924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:83⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:13⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:13⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:13⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:13⤵PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:83⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:13⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:13⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:13⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:13⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:13⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:13⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,1115519324491741102,5631668920509790119,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
5KB
MD57d19a249e14ca5b0279d761a4b454ed6
SHA199e7020a66c79b01101745b1974199f5cf9c3261
SHA256d5aaf175e94e67038864e103ede98c26681131b1bfacc98b3ea452222d8523cd
SHA5126bbb6185966095f32a5d5b63b9d18f4b75eb2b771944a140af4a39f2aae644bfda5a43dc438723e0f36f89980ca69c52a4c267deef35eed0b449df3846929f41
-
Filesize
6KB
MD50d80c4738f7743f4769387a376661ca3
SHA1218d755796ee620def08848e20054e5484980f76
SHA2563a5025f1d95e3d719f248362b8af09ed91aa984611dede37edfb299f992a29ba
SHA51242b2471295f33ebe08699060300228ac15ef4cc0c1a53638bbb6962a54f634b40c8be43c5d01d2b0733690f5235b9bef89a9755b301f92a0d577e84037989495
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5629f7da4099c862d77846174081de353
SHA1a7f466ff0d9dfda1ef27dbef84c049001baa0efc
SHA2568c97938725dec41b820786d9ff1f172edaa096fd53e8eb316c48575031656ca3
SHA5127cfcfe494b16c8453914e3be10cb6b77dc6643822390c218fff010d276244800742f2091b4fff7bd5a16582a264b395b4c08f18db0136e55afd3ee4d87ad01c1
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
5KB
MD59384f4007c492d4fa040924f31c00166
SHA1aba37faef30d7c445584c688a0b5638f5db31c7b
SHA25660a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
SHA51268f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
17KB
MD509caf01bc8d88eeb733abc161acff659
SHA1b8c2126d641f88628c632dd2259686da3776a6da
SHA2563555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
SHA512ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
1KB
MD51ac15c4233796c8e27e6aa863b3d2c7a
SHA1a10510265748f4639698dd25e9e0cc8fbdb4986c
SHA256adcc480508500c7776e6064e3557a562183e142505d80aa6ea99fe73e244cfb9
SHA51233648c39a2ea0d759cc741c5683aa22aa77a5e3237af5e126c3c4d7c3d0cc72915cece5e236546c60469ea1e0dfa769a03c75de956bbd994702d114dd449e962
-
Filesize
7KB
MD5122754bdae09014ed8be78a8dd3618c0
SHA18a1d4a0b8202d2261a12d97aebfe33144c274444
SHA25667552ebf58e98e841dcd9f4213ad3eb134d595f04839771618f0bb1c48ea2b92
SHA5127b9b5f8b52db793b4833a75bd8f122f28f2df00d43bd35efc831c2b8457009d51fe39874c691389c2fdc87ed411919b59da50199e3f719bd4cfb166367f185d9
-
Filesize
820B
MD515c70a60db44e88597d80f47e2737cbc
SHA13dbb85874e46bc2dfc8cb7673771ffb3f3447ce8
SHA256c1500657c22097893902b3b260278e6306174c2ca977bb17532a4b524753f7c9
SHA512e2bf670150d1c1ecd1fbfedd75ca93bb3be75b6c26c443e80759725fb97c9f4ec8020a6d18a5cd2586425d579d33965b00d855bdace1518f632c4ca8c6646791