7cdea49f4331a011262fbe4605f0bc56abce3641e3f7561d00058d092222a7fd

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b8a5b2d4c77010457dc7443830f246d_JaffaCakes118.html
Size

24KB
MD5

1b8a5b2d4c77010457dc7443830f246d
SHA1

2f671783934853fdfa0d15c4432da2bd369b007f
SHA256

7cdea49f4331a011262fbe4605f0bc56abce3641e3f7561d00058d092222a7fd
SHA512

d6fa924b0cd06c76b843393e10b5f26e71ca347d2f79cb70771a0fc9f914a8eb20b4e979df3f09b795539df24429ea1746357c06e61442cdfa4b26d74255d082
SSDEEP

768:TbUDC7wFUeBq7f7K8fpM9LqqhEkPcU5Ig2Oag4w:HWURf7xYbhNPc6AOag4w

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

77 http://btc2016.atw.hu/index.php?welcome

flow	ioc
77	http://btc2016.atw.hu/index.php?welcome

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3272	msedge.exe
3272	msedge.exe
1240	msedge.exe
1240	msedge.exe
3960	identity_helper.exe
3960	identity_helper.exe
5500	msedge.exe
5500	msedge.exe
5500	msedge.exe
5500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

msedge.exe

pid	process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1240 wrote to memory of 2444	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 2444	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3456	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3272	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 3272	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 1656	1240	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1b8a5b2d4c77010457dc7443830f246d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2346f8,0x7ffa5c234708,0x7ffa5c234718
2⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
2⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
2⤵
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
2⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
2⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
2⤵
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
2⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8428 /prefetch:1
2⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8412 /prefetch:1
2⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8840 /prefetch:1
2⤵
PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8124 /prefetch:1
2⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
2⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
2⤵
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:1
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
2⤵
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7352 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
2⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
2⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
2⤵
PID:768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13932130619185188626,12365451940421102427,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=9212 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023
Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
1e70b779a123bbdc3215d2f514591dc8

SHA1
00977fe35a17cbf69b6907aca2fdfe957b87989f

SHA256
22d828c821190a69afc1aa7e1ac110c4e5b3356f7c5c13c0de24c9b60e86c458

SHA512
a4237e98406e28c82ef63bdbafb37a97a99e7de2766300d033ad0c7faf5aa4e9d9468c2fa4e0cc3b542a82cb99072fddec92aa15f338434e6bb0d6c22b6ae9c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
493177125ceb7889b8cef3393051e271

SHA1
f1ee81e651569e9d7ace7d9d9fffd12f110429de

SHA256
bd925a062811c275b6465a5e0cb17ddf21a9920e46fef6ebe39f81d30f314aa3

SHA512
acd7e1c151a50395e739cb32fe0ae4434415ffdb2e3f3b3f36aea3eff8af6a0783cdfc50731b5b8abeb5e30d539554495b8549dfb763a936a60cb553c375c76e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
edab72854c64d9920328fb4cc0718afa

SHA1
79a3a4c1261e90fcfc6c0e8857a13e8bc9d9aa27

SHA256
10f0685d9a235f22ae60e524e21d8c3c31fb9c25ea856d8712572d78e7eae85e

SHA512
bc4ff28fa3d108f1f75a158fd0203386eb78ef8a480562648c948c8e095cbc887a47df27b7edc45f91281f0aba1453e6ce2782543913f72a54179d7cd3c51cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
7023a58bc70c1397a72794e5fa557e43

SHA1
f74b4239c5eb4bbf76c9955343bc9faa88ed8a88

SHA256
c1ee760232f37a0cfacbf50903c63a2c5603c6a02caba756bb2fa8f82a57abf6

SHA512
a0e743a1a003d3129bcd499bf4d7dc3f10cce30b69b6004f48ad03d0b0569c98ac951d72f49b102b203f0f2a1c4349f1923fbbbc2cabbe5dfe651db2e591811a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
917f5b622f6fa52ec4bb349774474d9e

SHA1
07839351705c143fc098ed54b818aa9f85dbc0bf

SHA256
91db843d510546e77ade141c9c549ea61a15d685d7c59f24abafd522d1dcc184

SHA512
83241e6e17d0df8f6575a59c005943c379f85ab20f7933510fe547d6b7b9255835576f02530a37d33eddd5e2d4152986b3c15d08f5972f6cb05e4be5c8c227c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
8bbcc3b4ef0714bb26be2a1139cd6d8c

SHA1
b840c4d7e894e086bdb312c718c5d4acddac7627

SHA256
34fa617a9de9ac5f5c90909671dd7473b1a9ccb0f430ed520d308df0c5faf37b

SHA512
7583e7ab82498492bee5183341ce84172f747d25ac0a402b0a812b2bff832240e61e75f7028de3993d10bf138dba72d64c2f48fe3e3acc49207e56f0f8818843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
07ee402c8fac6136a1d0f0af8c5a41f6

SHA1
e954c380b22af01be889bfd159cbb07853b3d49c

SHA256
f434bf7b57cfeba05f8a6758bf5978bbfc8c0358a31e08ae916cb1a275973826

SHA512
7793438950d70e076fd13e3573966abb6ea98a23774a298a383a1e17f55dbdc5737f5f7d661e5d01e0e223999afa6e248ceb4e4debcfb538db0222c6cb6af333

Download Submit
\??\pipe\LOCAL\crashpad_1240_TPLCTSRMLOMWYCUA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit