4333cbd9b3fff264eca42d6680190f69adeca6ba668f4ca182663320c15e1c05

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26cded55d1fc320c0080a2aeb61c87de_JaffaCakes118.html
Size 112KB
Sample240329-tvlctsch56
SHA256 4333cbd9b3fff264eca42d6680190f69adeca6ba668f4ca182663320c15e1c05
MD5 26cded55d1fc320c0080a2aeb61c87de
SHA1 b466c6239f1e94e0001be66523c1d1d5b7d5e38c
SHA512 f1f4a1c74bb16b57f7d10380688d9a3cde1cfa91283424fdd333ce00bee4fbb8d9564e2f6a5e183e26c336b983591631f38e750ac83868b8291b309d44fa40b4
SSDEEP 1536:NEFwEzsTFenBQ7/JGHtiQrWY1RTDQO79pq1RTqu5imxC3564S:6/6FF7/JGlWY1RTXs19ZNE356z
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
8	sites.google.com
14	sites.google.com
15	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3564	msedge.exe
3564	msedge.exe
1164	msedge.exe
1164	msedge.exe
3916	identity_helper.exe
3916	identity_helper.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3108	1164	msedge.exe	88
PID 1164 wrote to memory of 3108	1164	msedge.exe	88
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 2036	1164	msedge.exe	89
PID 1164 wrote to memory of 3564	1164	msedge.exe	90
PID 1164 wrote to memory of 3564	1164	msedge.exe	90
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91
PID 1164 wrote to memory of 4788	1164	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\26cded55d1fc320c0080a2aeb61c87de_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7ea846f8,0x7ffc7ea84708,0x7ffc7ea84718
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7728 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7561972114048917005,12280271498879395927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 20KB
SHA256 e1e55887f81363ce752f53f8c92a155fe041292b48148134018a0476cfd8f204
MD5 2241efaf8a5d6561e64fa7e97dd66e78
SHA1 7b1f677f739c119f878cf3a31e02c2af7504bb54
SHA512 78137eb3866b771554b70ce90df1354cba5990602018ca677fef64959188fb40a4c23edcb8faac9367db57d0a30cea61a52cabeec10114a1321e9488a8543178
SSDEEP 384:uCRvYuTan6ogpAEq9Z9/KglNEvPm6rvcmek7xKsyeErgFjthjDpqy73ZiloHozrW:uwYeEP9Z5KXe6r0peaeE03hjDMyVQ+om
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 44KB
SHA256 d374d2ac88b65c3b78fdb96d2c6398493dbee61549b39c3880a584d2bb1be825
MD5 26a55dcc6250e84042b29959f5e50334
SHA1 fc02ef852f17b4f9ff54e7c677145809cc205759
SHA512 33db6af42c615f586b412bbfbe0b92126f91c4b80f9259ef94aeea103498cb53396e28c0e9b1c10bde0802915f8c8877c596f07a5c5c61f4a90cb1df06f67c4b
SSDEEP 768:8k0wARCGVFSAxFyVzOe/EnZjLBAGNa6QVQ4GIkrGIewwVSBPNbmHUuq5XQrj:8k0j5bXk/cndVXQ/TGO9VSBPBmHJqNAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 d28b1a6447bc653609e715b1836db720928349b650a1697f61c4b74ec8ca43ef
MD5 b368e538e1a8cc04c7e397a2e5528763
SHA1 f8158a192caf6bad37bc4f61e90d465ae178d162
SHA512 9bf45ba57385ba11618cbf487ba288308eae96ad4eedbffddbb9e537044b0f43ccdfb1ab603e6c8a3084bb23f8db36de0d792c597cf5cb8f079c416797d426c9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 224185e6789bbd0626f826e0a3f4abc4d0addb5906666d3695384f1215cb878f
MD5 c5ed5fb6bed130eb199905fa127caca7
SHA1 05a5fd538a8c2375154902369b53f871afd2beea
SHA512 ddddb09031fa7a8dc0d9c8f6c18ab3aab7ca266be49dcff65750644440e13b7d377adef8befeede1df7fa2058815c1b1d7909e6dd0460f8b77a71625500c16ad
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 1ad4e9c27f0b49ede3ce543f8c5296e4d4f8435787552bfe0ac251ff6bc8d34f
MD5 667b2e28755d3212adc319cc1108870a
SHA1 768d0699f0669f77bf3d6c4a6176adfe1b18e0cc
SHA512 2870e5240d746b464839e665b24d60470765126cb91facb4a71ad2cc69eeb9033e5b42f4c68b0f8a164af19e8e147e42b1aceb9635d8609bd669ef1444b4a809
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 c1dc82381f63ee8a777c321b2660151ce6b1cde58e3f860a8f349902fca87577
MD5 be508611028c542567e3636e6ad680ee
SHA1 f1a79c8953f068ef499fc10911f76817b3d757ea
SHA512 3c9e6ec1b2c8b71db87097070e753597f7720d664e26dabf5afff08a557d8cc847c0229e76717420b0fc3b2c97fd1413f50cfd9ad2b09baba99cf1fafee48cac
SSDEEP 96:Pqx7DNvOUu89w+f3pTn6r7G8GkNGKGiG1xGJG9GbjG9G4EIGZGaGPQFf:Pqx7DNvOUu89w+f35n6r7DrN/XWx8PjN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a19ce8f02b931b2fa3ec25ec32f9b5958594f616a2a5d74f0227928991ff17b3
MD5 1f9c8c65e14d1d29bb774750af92f7c0
SHA1 ac93a41cb8fa0d7513528e4b3eee77670e477090
SHA512 7ef726fd76ba43be03c8cd3360aa2bf8c8268a07a024c73a877ffcdb14931842b5f2913bd414730a5b5b8ddcff67012110728e6e92c3b510677d47536e5e3c6b
SSDEEP 96:nTktFk192wpvWMoiVmdeHOHTsHUWQyV+VD7ziEwb:nTkrkv2GWMXETyrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 4a84fa3df97936f8f9bbb3f2fcb0ffd8e16f3f8000429cce973da42d8d1becdc
MD5 4489e72e97fcb58f64bf814a6fcdf961
SHA1 affeb26bf9fbb93a9b4b534aa6934ef8ae9ff7f3
SHA512 348f75aadd12d211a4d7678673b9e14d99dbe1bc42ed8afbb8e89db46cd08c8251947faea5fa1ca11b5a9f74aa2683ab8d4bd75c6ed7be8d98fd5ac13a9ed8a4
SSDEEP 192:nTkskvF2GWMMNfUpfTdI9J60YsIqMErvsNa652ETyrg:nTavFHWkbsr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 0760f263c38390c265777e5a583160224891b5e90c7979566e71cc8ca59cc117
MD5 ab192e8629168cd180f1385af108f2e6
SHA1 3178873b58fc5efb409d9b9a156d291f3005ee4e
SHA512 df23c3370a092c5379adb757adad7cd02a58472fae787da3c2354203ad50aff0b967d2aa9e69b5e30bb2c704707c7841c8e9e49c50a5b5cd419f94a39b83526f
SSDEEP 192:nTkskvF2GWMMNfUpfTdI9J60YsIqlqMErvVFsNa652ETzrg:nTmvFHWkb/rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6bdb8b3bda4d164c398da7cde96e0b8334ff1d0f6e9740e2468312a6779e5c77
MD5 d092611ec9b9054aa4505c888c812f7e
SHA1 da5a1511ba92f531e6bb8f888757014df51380d1
SHA512 a563afeb5f51185212ddc8168fe908c71bde5073bd2d403dd9537d083d46f6252cf7f9292638b881a9d4a72564e77e0f2272180f738c05e57018934a803f2971
SSDEEP 96:nTkoFk192wpvWMoiVmdecNfjop5IVD0IqMs62OHTsHUWQyV+VD7AiEwb:nTkskv2GWMMNfUp5I90IqMs62ETyrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 85982b88fe5a286d46feba036aedd1c037a5b1041bb0d93d91d1bd4b1a44d3b6
MD5 1acd1b2b07b402a640cc7ee1c2b1a196
SHA1 7045251fb261630f4ccbf6212a77d1b738ec2993
SHA512 07270c0a6ed9a53d6227e6294f528dbc755ca2c886d23faa90f09460ab0f0bd2e4849d580f254ac86330ee01632906e049d7db21e2c2b2fc3db2d79827930b83
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b6bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b6bd.TMP
Size 872B
SHA256 cd318b927ccf08d612508e699538da503de935400b4dc58cbb16b77565d8d04d
MD5 7ef343be8514762daff689d9810264d9
SHA1 4737cda975491a81c4c9ce6ce7b1d9bb488cf8a4
SHA512 932dafa802502a97c3ba66be9c1294d91b80a470a991dcd25eb2f23e7b00347b39a75880e9de91ca2979023502b91bd6a92e2c06fef1e427f9086ef2be346565
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c7eac4cfcec5f330ad5de4bcbcc9991de5f473ec774b16b29082aa0c265fb721
MD5 9543088eab51e5955f8e5ab604d42665
SHA1 d1edb84a7e2a20c8eb245c097a95468036fd88be
SHA512 4d4c538d6d2792e7daf03ee84fba89eea877f7d43f0f4212504cb9714f3addbe2630ffb19e7175e76acc379017409d74bb3e6c20a57ed3f504ab8d99f2fc9b24
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGe2RUdxI4bR8znIYWLSDgX:A9iIxuERzA83h09RZxYI1o8zIDG8V
MD5 SHA1 SHA512 SSDEEP

Submit Download