f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

klkjjk.exe
Size

3.9MB
MD5

0d28c308c7d3af1f50a24cd98d59adbe
SHA1

617eb940a77fffe2e8363f9a11430ebb56b4c988
SHA256

f917cbb00490f27691097081db77cc38d0f776d374b2fbd40e4b592eeef578be
SHA512

d71da6edef67bc977ac8564f75cc0e8cdd31c0a9b37253017122f522c4d2f1ece5d8a56642dab40e3d8651ad1d1233ba0a27f78a536ddf897ddd392dbebb5ae8
SSDEEP

49152:/YQ9p/TMILu3UAJvYIJ7PBJw47zI8gFEtYnEZhNa+uOTapp5pP7eoi:DpgQEZPPT4Yj

Score

8^/10

microsoft evasion persistence phishing

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

klkjjk.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	klkjjk.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

klkjjk.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\klkjjk = "\"C:\\Users\\Admin\\klkjjk.exe\""	klkjjk.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Suspicious use of SetThreadContext 1 IoCs

Processes:

klkjjk.exe

description pid process target process

PID 4092 set thread context of 2108 4092 klkjjk.exe aspnet_wp.exe

description	pid	process	target process
PID 4092 set thread context of 2108	4092	klkjjk.exe	aspnet_wp.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4176	powershell.exe
4176	powershell.exe
2460	msedge.exe
2460	msedge.exe
2852	msedge.exe
2852	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2852 msedge.exe
2852 msedge.exe
2852 msedge.exe
2852 msedge.exe
2852 msedge.exe
2852 msedge.exe
2852 msedge.exe
2852 msedge.exe
2852 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4176 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4176	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe
2852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

klkjjk.exeaspnet_wp.exemsedge.exe

description	pid	process	target process
PID 4092 wrote to memory of 4176	4092	klkjjk.exe	powershell.exe
PID 4092 wrote to memory of 4176	4092	klkjjk.exe	powershell.exe
PID 4092 wrote to memory of 2108	4092	klkjjk.exe	aspnet_wp.exe
PID 4092 wrote to memory of 2108	4092	klkjjk.exe	aspnet_wp.exe
PID 4092 wrote to memory of 2108	4092	klkjjk.exe	aspnet_wp.exe
PID 4092 wrote to memory of 2108	4092	klkjjk.exe	aspnet_wp.exe
PID 4092 wrote to memory of 2108	4092	klkjjk.exe	aspnet_wp.exe
PID 4092 wrote to memory of 2108	4092	klkjjk.exe	aspnet_wp.exe
PID 2108 wrote to memory of 2852	2108	aspnet_wp.exe	msedge.exe
PID 2108 wrote to memory of 2852	2108	aspnet_wp.exe	msedge.exe
PID 2852 wrote to memory of 1752	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1752	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 1600	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2460	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2460	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe
PID 2852 wrote to memory of 2412	2852	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\klkjjk.exe
"C:\Users\Admin\AppData\Local\Temp\klkjjk.exe"
1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_wp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93dd146f8,0x7ff93dd14708,0x7ff93dd14718
4⤵
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
4⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
4⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
4⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
4⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
4⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
4⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
4⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
4⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
4⤵
PID:5388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
4⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
4⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
4⤵
PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,18273805963095300579,4620631871413371121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2436 /prefetch:2
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_wp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93dd146f8,0x7ff93dd14708,0x7ff93dd14718
4⤵
PID:5652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
daec888da282aeeb6e03940669f29e66

SHA1
2ff9c2f9fa89c52767dc03f18feb845e6aabfad9

SHA256
85ac5baf33c0dc315b16260defa3660ab885fa9622ce2e017d036cac3aa35ab4

SHA512
f7bec5b0d3039617f5515bed303d5644a685b4bf9148f093ef989244e88f65062a657edf1c8cef6ce635f27a44ba90a7387a6ce313e9bece374bc816da683628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
04089fe6b70a0ed9e86f97b2ee95b596

SHA1
f2810ab56e2764a25573397fa0a25405e929ab85

SHA256
01d899cf39f04b5b4cd7b47c7a35fe38c8875f2e10d9d288240a10ff9b031f34

SHA512
a9eb6b01f8fce854a1b95d165f5dcd3f0b2881997dca032f31f024283948cd9b717983093cf91714faecdef92605871f693b78aeb2ee64441af073355cc7b191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c4654e6572419b374f412ba6125273b7

SHA1
6a7755706ac2d115e5192530d015c2e185781b67

SHA256
15fb4c0f1f1fff61071800c518051c5027953d715cab3c1d3606b546c897905c

SHA512
21f3dddedd7252504bd25a202ecfe8131876d2642f9e8bb6618d58e1296a01eb2be54c72aeb10926ed9d53bee5ee6e59fd58c071a7ae1ae58bed4e518355d936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
693857daa5e1f58354520970f21fa2e4

SHA1
387e321d4300f47c6b95174c0455779cdc307163

SHA256
189595ff486b88cea7a119f56ff5485b66b5db42f33077ff0f76e16a65d3b77d

SHA512
2e6d91c831d84d9c066afc40d84bb32fb2c436db5f5a1d3f1901d079ad4436963753a74e5d14cdb7ec74c089c806845406acdd8e16ead68d91b7a8341926f10b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
369B

MD5
285affde51114eba856082bad0eb99df

SHA1
17cb569cc978e8aecd0affccbf9845a3f3131d43

SHA256
9ab0961d410ebb903ca6747c62f292217cb36b51d8f1765131cbfbce7b581a27

SHA512
7eba823ec3a735e16525a177a8049aac72370351b613b81c292a4f9255a5e4b9bb10ddd94aa648e7b18c2e8487ee22519f1d06ae39f9d9fb7089d35b85fa8622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a393.TMP
Filesize
371B

MD5
27893bebcf4393f97bd0e36ed9b7de8e

SHA1
88fb1b5d9f5146756709622a879a548451c4cc5b

SHA256
b6e086bbc1b9328ec246f788c34ae2b72d4db20a92c2ca66e3bb978a0dc6aded

SHA512
2574065317b59ff02c2bcd7a6464dfdaef618dfd77056a8a8e56525824f30d33c1a335a7c2c6165aca4ec139fda63bf72df2db70f18e1aa536110bffaa03ca37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
cb8d35cd6da1741ea9e1751d6cad53a2

SHA1
81c9a334691f8465f9be4deedfc64e5aecccfe9e

SHA256
bb0b3e91201868b2c9183508edb0d87cb2a5b9b4e01e44e4bcf6f9c5e0a685d4

SHA512
1eac3bfab70477aff9cce097c0e76bf452841183a5408c8769bcbd0cb9f363469fadf0b5b208f201653ab58906757cc794e32da8ad37bc89ef05e59786f385bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bkfv1dg0.pty.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_2852_DFNPUEVNDDAUPZBL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2108-16-0x0000000140000000-0x00000001400A2000-memory.dmp

Filesize
648KB

Download
memory/4176-6-0x00007FF93D4A0000-0x00007FF93DF61000-memory.dmp

Filesize
10.8MB

Download
memory/4176-17-0x00007FF93D4A0000-0x00007FF93DF61000-memory.dmp

Filesize
10.8MB

Download
memory/4176-12-0x000001D76F560000-0x000001D76F570000-memory.dmp

Filesize
64KB

Download
memory/4176-1-0x000001D7716E0000-0x000001D771702000-memory.dmp

Filesize
136KB

Download
memory/4176-7-0x000001D76F560000-0x000001D76F570000-memory.dmp

Filesize
64KB

Download