f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

klkjjk.exe
Size

3.9MB
MD5

0d28c308c7d3af1f50a24cd98d59adbe
SHA1

617eb940a77fffe2e8363f9a11430ebb56b4c988
SHA256

f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be
SHA512

d71da6edef67bc977ac8564f75cc0e8cdd31c0a9b37253017122f522c4d2f1ece5d8a56642dab40e3d8651ad1d1233ba0a27f78a536ddf897ddd392dbebb5ae8
SSDEEP

49152:/YQ9p/TMILu3UAJvYIJ7PBJw47zI8gFEtYnEZhNa+uOTapp5pP7eoi:DpgQEZPPT4Yj

Score

8^/10

microsoft evasion persistence phishing

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

klkjjk.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	klkjjk.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

klkjjk.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\klkjjk = "\"C:\\Users\\Admin\\klkjjk.exe\""	klkjjk.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Suspicious use of SetThreadContext 1 IoCs

Processes:

klkjjk.exe

description pid process target process

PID 412 set thread context of 4848 412 klkjjk.exe wab.exe

description	pid	process	target process
PID 412 set thread context of 4848	412	klkjjk.exe	wab.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
556	powershell.exe
556	powershell.exe
4548	msedge.exe
4548	msedge.exe
3480	msedge.exe
3480	msedge.exe
4072	identity_helper.exe
4072	identity_helper.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3480 msedge.exe
3480 msedge.exe
3480 msedge.exe
3480 msedge.exe
3480 msedge.exe
3480 msedge.exe
3480 msedge.exe
3480 msedge.exe
3480 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 556 powershell.exe

description	pid	process
Token: SeDebugPrivilege	556	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe
3480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

klkjjk.exewab.exemsedge.exe

description	pid	process	target process
PID 412 wrote to memory of 556	412	klkjjk.exe	powershell.exe
PID 412 wrote to memory of 556	412	klkjjk.exe	powershell.exe
PID 412 wrote to memory of 4848	412	klkjjk.exe	wab.exe
PID 412 wrote to memory of 4848	412	klkjjk.exe	wab.exe
PID 412 wrote to memory of 4848	412	klkjjk.exe	wab.exe
PID 412 wrote to memory of 4848	412	klkjjk.exe	wab.exe
PID 412 wrote to memory of 4848	412	klkjjk.exe	wab.exe
PID 412 wrote to memory of 4848	412	klkjjk.exe	wab.exe
PID 4848 wrote to memory of 3480	4848	wab.exe	msedge.exe
PID 4848 wrote to memory of 3480	4848	wab.exe	msedge.exe
PID 3480 wrote to memory of 4976	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4976	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4248	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4548	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4548	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 1560	3480	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\klkjjk.exe
"C:\Users\Admin\AppData\Local\Temp\klkjjk.exe"
1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Program Files\Windows Mail\wab.exe
  "C:\Program Files\Windows Mail\wab.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=wab.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd426d46f8,0x7ffd426d4708,0x7ffd426d4718
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5623247471001122233,10066753941520271945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=wab.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffd426d46f8,0x7ffd426d4708,0x7ffd426d4718
      4⤵
      PID:5928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
8e04d4d5cf9fe4fc4a55f9222d109143

SHA1
9509213c5a12cc5b639796a576a3e7afe4f1af4d

SHA256
0bd1d7bcf8e5709a56c89d378433d5b679fc2f28b6976d5e94db161f05584c11

SHA512
c674658d3282618b35a297c049725c8a88327fc6fc7be57f2cfa03efdbf7211e4db19a63d55f706a7084d18bd0a8dea939be69becabe1191f61c6b52417eb2dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
61a7bb261aa4db6dc31ae97b72d0fe45

SHA1
da848b43f5e3fea4fedd6ad541ef64b638a5cb37

SHA256
e616760c9f5a3f1e6c70a45c8a6b9600a6a07ec40397bea20621542dd59cefc8

SHA512
200f15d52b66074ef7b1bf0c92bcda11f16bf577e9cc0540af18fd2ad069a219d382e21a719c88c4a11b3ff882667c1c1b8a21e7ce3da4b6664e93bc7f6aefca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
370f86d3b201e9e2a90ca645e8b00e8d

SHA1
5e0030c1092bdc0cbfb17d4ff309357cc7324c2d

SHA256
3fe020f6cd79c7bd6c3b0e6f57f46e8f558b6f676ee3f876f3846e4234c317ea

SHA512
f8c3454133677d1157111f324e7a0d9271dc5ee80c39c5334405477d572fc3e734850330b5c31e0e64f36e2e3bb5000cfc92c000015332860027d041bdeda2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
318cecd3feb1920581f4ca6fc2d7806d

SHA1
51700062ebe5ad4b7008c79bf696093566bc2661

SHA256
57cf0d502f5c904f9bfe8e30e4ee5f0098869f43de1774b240c617ffcbc6c63f

SHA512
a7901f6c9d0cab1a3361df588b83fe70d0862d2147f67ecc4b0ec0afc1b2750d7bf9b39826dfbb8c5ab7af826eb288a3fd4b7ce2c132e5cdf8942b5b79e97258

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
508a7ad02bfe9a8f0042630832e3a9de

SHA1
2a0e4194aabd28d5cd3ea13c19fe7d2206faffd8

SHA256
2b00f074a4585ad02e61e9fbaf0cb02ce929cb15869ebc845de5f002a930da0f

SHA512
c96446ad5d371d019cd9860a8f1514a39778135a3fd158e29182be05193b9de55a4cea7f7aed254e7cb37446e71a381ff95a7ab1ec1edc612818442f1e524da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579d98.TMP

Filesize
371B

MD5
afd2455d86e60005e9a00109a627774c

SHA1
81cfdc3aed64d58c09e46a0ce6bc2aa355067961

SHA256
36737cac1b22c9de2c606fd8b227994d4cd8d11df857c425a3ab187db533e5d4

SHA512
8f74c26c27b649be89755c680706230d41eb6e3f32e03f4115286f90023b1042d7f97efaa2b12ccad0f2c7f1ef337d8308a5a05190801644fdf3e3bd97c09d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d242e0ae71cf7177464ca6a0df7971e1

SHA1
aeb30f0f497ddc4b2294d3640dfd295a4a0e5222

SHA256
ad46b61daba344b9605d26e9c1f34744bde14c4494cf80ae62560789110acdfa

SHA512
0a951759fdcdc1ab6787500b051dd2bc0ad3e62e3a29c462f12ba0f72e8d406712c65d2bb957b856b4d9ae207f6c3e23d9e3c1f9b4c8e3e2a991d087009cc9f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iygls1d4.0w4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_3480_YEAVCKGQLKSETVZH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/556-15-0x00007FFD411D0000-0x00007FFD41C91000-memory.dmp

Filesize
10.8MB

Download
memory/556-12-0x000001B3D0290000-0x000001B3D02A0000-memory.dmp

Filesize
64KB

Download
memory/556-10-0x00007FFD411D0000-0x00007FFD41C91000-memory.dmp

Filesize
10.8MB

Download
memory/556-11-0x000001B3D0290000-0x000001B3D02A0000-memory.dmp

Filesize
64KB

Download
memory/556-9-0x000001B3D0240000-0x000001B3D0262000-memory.dmp

Filesize
136KB

Download
memory/4848-17-0x0000000140000000-0x00000001400A2000-memory.dmp

Filesize
648KB

Download