e51626bdd88db36afbaff56f8cac9a61972515850186b34e6420b4853e03d0e8

Analysis

max time kernel
43s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UDisplay.exe
Size

5.0MB
MD5

95646ff7d98ddf540f238b3ffbccff2b
SHA1

358a10e5a103ab9345b1089b25cfaba1608d3526
SHA256

e51626bdd88db36afbaff56f8cac9a61972515850186b34e6420b4853e03d0e8
SHA512

9dbbe3b21c2aa237f3a17e1ce2bb8b970f54ea5d31f432257fb2ed244d76d0e46416ab00bcc06eff4039bb584acf51d36bd656614e3eeffc63ee652492f9b31b
SSDEEP

98304:TVfWNnk8JWgpukTAjEalth5x35xRDAH/EWfO:BcFQoI9t3DAH/ES

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4820	UDisplay.exe
2352	UDisplay.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UDisplay = "\"C:\\Users\\Admin\\AppData\\Local\\UDisplay\\UDisplay.exe\" daemon"	UDisplay.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
4824	msedge.exe
4824	msedge.exe
348	identity_helper.exe
348	identity_helper.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe

Suspicious use of SendNotifyMessage 57 IoCs

pid	Process
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4824	msedge.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
2136	UDisplay.exe
2136	UDisplay.exe
2136	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
2352	UDisplay.exe
2352	UDisplay.exe
2352	UDisplay.exe
2352	UDisplay.exe
2352	UDisplay.exe
2352	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe
4820	UDisplay.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 4820	2136	UDisplay.exe	93
PID 2136 wrote to memory of 4820	2136	UDisplay.exe	93
PID 2136 wrote to memory of 4820	2136	UDisplay.exe	93
PID 4820 wrote to memory of 2352	4820	UDisplay.exe	94
PID 4820 wrote to memory of 2352	4820	UDisplay.exe	94
PID 4820 wrote to memory of 2352	4820	UDisplay.exe	94
PID 4824 wrote to memory of 1672	4824	msedge.exe	100
PID 4824 wrote to memory of 1672	4824	msedge.exe	100
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1868	4824	msedge.exe	101
PID 4824 wrote to memory of 1944	4824	msedge.exe	102
PID 4824 wrote to memory of 1944	4824	msedge.exe	102
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103
PID 4824 wrote to memory of 540	4824	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\UDisplay.exe
"C:\Users\Admin\AppData\Local\Temp\UDisplay.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\UDisplay\UDisplay.exe
  C:\Users\Admin\AppData\Local\UDisplay\UDisplay.exe main
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Users\Admin\AppData\Local\UDisplay\UDisplay.exe
    C:\Users\Admin\AppData\Local\UDisplay\UDisplay.exe daemon
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb18f246f8,0x7ffb18f24708,0x7ffb18f24718
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17003073610423771487,4768851713652113232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7799414287fc0bff817b95694366299

SHA1
2a6f9c4c951e2a66584a738b8f56298a3dcb8749

SHA256
4e5f4955128c3670bc9ed0b8479f67ee5df8c2a96322a01ad6bae57960e71788

SHA512
7b6d84f17e9e40258dfb92e85318846d127af4a64e7702cf49206862ff35e5710344f96266ce2d479d94b7915655b1a564c41925c4677ad96418b9e3d75ddfab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ddbfc2f20c5f5e7fcf2712de8dd5a76

SHA1
1a804dee2e071ee2c9335d66d96006116eb74972

SHA256
aa04bece2abbac96361b610d64bda4ea48c9f9a8d81bf00e29a80d389c28ac36

SHA512
91e6fcd5ba04e1e0d473e7309be345822285273f0959232bececb87d7ed7c0bbaf2ce5350ed0aa2dee355cf123ce5983ce40a6a3024215feee376da25f3e6f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
32ce74b2bd4df1d52b4d0053da66c641

SHA1
cbe1592c239c6cbffd69051159120a099924b622

SHA256
c86511a5e79ba407312d8154097474e412f9762c4bc97a22712c84ff77ac9a8c

SHA512
2dd62276cf5368e027153ed63f1f98978d50ab861c0a1f2b315da27a2ee3750d9210c3149be5eb83d49b2cad2f2e8a4868101bf63de21f1c9212d639266b99fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2eca0c8f088d93e39f554dc4933d2eb5

SHA1
13a91ceae4d20b2673b308d1c63e7cad74d43754

SHA256
d9505d6c0a159d248793149bc81cac2292c5b3e5cca3f54410de9b28015436e1

SHA512
32364e3cf310cbf35ea1bac1c7c7045603eb11db7689eb8db170d67467a5f296c4ac7a9a37ea0dc7f1ba369aa10758d25310a2f236cff29c49ece2922e62cd79

Download Submit
C:\Users\Admin\AppData\Local\UDisplay\UDisplay.exe

Filesize
5.0MB

MD5
95646ff7d98ddf540f238b3ffbccff2b

SHA1
358a10e5a103ab9345b1089b25cfaba1608d3526

SHA256
e51626bdd88db36afbaff56f8cac9a61972515850186b34e6420b4853e03d0e8

SHA512
9dbbe3b21c2aa237f3a17e1ce2bb8b970f54ea5d31f432257fb2ed244d76d0e46416ab00bcc06eff4039bb584acf51d36bd656614e3eeffc63ee652492f9b31b

Download Submit
C:\Users\Admin\AppData\Local\UDisplay\udisplay.ini

Filesize
81B

MD5
4252858f3b3faeeff7ecad8350e439a7

SHA1
442c05c480281fc1466e97c4420795b0e53b79ef

SHA256
3f4864438082f42852494882d57eb28afbde368debbd1f8e82a2e5b44e31eb32

SHA512
80dc39e7a83aadb9e68162ac201b3abbe54f322ee21ea36904fbe74be69f6e6af5e51c7aef9ee37dd527039fb4f1112a10a0f2442d0102385b5648a7b7d89e78

Download Submit