75aef6bde84858fa7933e0080341d4c0eb073a0340362a2840748772fdab823c

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ee90f5288dc2525e5641a1b3e32c97a_JaffaCakes118.html
Size 113KB
Sample240507-bc1exsbc6t
SHA256 75aef6bde84858fa7933e0080341d4c0eb073a0340362a2840748772fdab823c
MD5 1ee90f5288dc2525e5641a1b3e32c97a
SHA1 08e0fae21aecc6e4aa4a9eec854d254b53165ae2
SHA512 fdbccbad85356bb1c6fca8d4c310da30e20a453b3055c1af4d8832157375e5ef9a30f14b7c09824db73cb5ece32aba2b791248692646d93eec876a4a5e4fbb53
SSDEEP 3072:w5o8Njz2S81Ep2svbbd21D6VleByTPBXJ27/P7UHeaA2gU1kE:98Rm1AkLY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
1676	msedge.exe
1676	msedge.exe
2812	identity_helper.exe
2812	identity_helper.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2948	1676	msedge.exe	84
PID 1676 wrote to memory of 2948	1676	msedge.exe	84
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 4832	1676	msedge.exe	85
PID 1676 wrote to memory of 2292	1676	msedge.exe	86
PID 1676 wrote to memory of 2292	1676	msedge.exe	86
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87
PID 1676 wrote to memory of 368	1676	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ee90f5288dc2525e5641a1b3e32c97a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8ba346f8,0x7fff8ba34708,0x7fff8ba34718
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,18025793216732340504,15686916241511344207,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x154 0x494
1⤵
PID:944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 df56b4d03df1348d67b39d5f233d6eeb708ee80496be0e077112769ab66eb194
MD5 267a73618b3dca4d90da60b146401e09
SHA1 5807fb57328416a63449388047c84cd17c835059
SHA512 a9d5d2d3c316622719627a594d42cdb7010bb9b50611c85551f7ff243b361509c10ab5bdd4c40150b3e9f109e5760078fa442a7de3e11d1ac8b00417aef0eca4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
MD5 8b2290ca03b4ca5fe52d82550c7e7d69
SHA1 20583a7851a906444204ce8ba4fa51153e6cd494
SHA512 704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
MD5 919c29d42fb6034fee2f5de14d573c63
SHA1 24a2e1042347b3853344157239bde3ed699047a8
SHA512 bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 44KB
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 ad61ebff7dfdd8223213170a4c556b3436c75839e02992e6e1bb94d8ed5a3dd0
MD5 893cd08014b693d9a3c4251ddeab076f
SHA1 7ea009101a29598a9da7fee3ba14466dcad8fd3c
SHA512 ae39047b3f671869689aa982d2671121f883f7eb3ee0df48bbae332f93ec0b00a991b18ada21ecbbc1b83dc7f50eed729a8a4fa150fb82e1b669dc16f7291841
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 28ea550f9d53fe341d6424cdf1fae67eecfa17cf29f1f326cfb9023518ea7fed
MD5 08c5848ce32b565e1c4c2617f2e13c3c
SHA1 ad3a1a9d769d862d56219543236fb601ec66feb5
SHA512 2fbfd8f3f16565d873c18262823cc7ed5f7a044e2360222cbaeb5ee8f46db54dc6f8a6dca3b511f66007b877daa3a01c423ea8060106310ac6bf868576b63086
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 26b4b38431dd321fcc9ebfd74f8852c702db03c765cd453c0c276e9c04dfc0a4
MD5 bf72366a83015fffa4dc06ae9e0320a9
SHA1 146930dde496c2a5d5961228dc89b1c5c097024d
SHA512 63b1f9d7722826dea3da47f460f2f2699fafba9c27678304c168f08382141e6f75a87eeb1aae895ee5f31182ff5cdc3da5cdb354d20f786f1e3f7b2765836e1e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 17879e6a0a6915741820447a8511c61e7b48796348704c9bbe1b3877237393fd
MD5 7aa747503561c14553a0d4e6738da54e
SHA1 83dfc799bebe8d77725d63919490a8e1a15e19a7
SHA512 1af230e4b0fd678a73d98b5bc30552a74626aab8591f28d529a1f8fd97669d1809fe5f642e29e3090db7a23f931858e06ba34a4a7eb5f345fa82b038b9ef9a0f
SSDEEP 96:n1khQm1k2j12wpvWMoiVmdeHuwu8UWQyV+VDCziEwb:n1kzjEGWMXFPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 25c3caed5f3604bd83fc571a921bdea8c4bbe4d754d9d5864943dd215b019587
MD5 a69d962954e4e7af330d2d17cbaf0d6b
SHA1 15cf82d9691f183fce48a487442a152f0a08a16b
SHA512 e535645879b88455085a43f191a4de89eb142ce29e521112326483266190cbb2b13abd16c73f8c4ec0321da322c2d3c4a75b47910c2ce8f8e4f38f087295dfe6
SSDEEP 192:n1kYjSGWMLexi+rrSKgcmpqZmqWhF4m+kx2FDrg:n1djzW4Hxwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ac718e7c2d0f6fc3fd9b2337246b00d4963cc4c27296c0107be6a0d6ab11459f
MD5 874c4af797509dc93dcf238a50d50401
SHA1 f1f541a2ad8d835668a071db7073c0ad81ec2ad9
SHA512 0abd483f5c2e250037bd41e1250765580e49cb97e3991bd92a622bd3fe2ead06a7d7fa423e889492834d3ef9da026d9e8ff7464514daf68362fa94c87b4a9ee1
SSDEEP 192:n1kV/SGWMLexi+rrSKgcmiWdqN3YdYuEDk52m6EroE7IVr71u62FDreX:n1A/zW4SarlHWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 71f73f1eff386249a4a34cdd3897ca359aeb27750766b18f9ce3afc33923c04b
MD5 d765dddcd996410553f060cf41b431af
SHA1 f42572868d5e301085f460063930dcc04b72e493
SHA512 1168c78c7b177424280101f5a339d91344e1765e022adb157e6f9c916ad58e3ac63b3c64c5ad491e9d73b04c481f422dbd3ba7a2832ebc8d0d15e8b5bebb3fc5
SSDEEP 192:n1kwjSGWMLexi+rrSKgcmpqZmqWhm+kx2FPrV:n1xjzW4HPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 8a1c58e1c40094dd16d3a6af4caf1caf66195bc2440744873e515faf22d96940
MD5 488713841bcf1ec177f96ca493a86f7e
SHA1 16902ace6f836aeb44f5323f84340d3b7a98e42f
SHA512 f91f6ad537f52d5dcf969c7a65f2bc453670b968a43172da1dfe5697ca91449e5141afdf4e58c30c809d1aa2762143ed41144c879b2ce9fa936454ad29729da2
SSDEEP 192:n1kwjEGWMLexi+rrSKgcmpqZmqWhm+kx2FPrV:n1xjxW4HPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3555c1c0199cbbe48b449b0d95923ab58bf34ee2031931281cdf5ef62bb647cb
MD5 cfa2d26ff0d4e91cefaebaa190d3eadc
SHA1 9cacf987c4cf7c17a2ee65545d59ec6f0c327e21
SHA512 bb09d17d1e85594fef8f0f4539f9d0cf810e6d2a4fc450f2de7271cc3c6613684bb7ed1cdaaa07862a1b489027e473b258210aa909af861b986d0820ddd09472
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a798d2c83f2396ea27fcb677ffdbb0741be3b8217725d8d82ba8054efbc0512c
MD5 4b165a9ce7dfb90c2ca7fe6e7f4279c9
SHA1 a25d038d056390f12c550a8ab6a67cd37bf18529
SHA512 fb4eaabe90a85b6e420c44b8111f28368b81968e7658f6c5101924b33446290f02c9013864028379db478827b69e22192d5a855ae0bc376865fe0bd8671cbcc8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5810e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810e3.TMP
Size 873B
SHA256 3ae28627d89a4ca6cfbc32b503ba2a6cdc8524e9d18ff06bb580acae38579996
MD5 0ca0efc28ff554cb17db239ae125c2df
SHA1 1d759e90c2bb2bf162c33f9796a29424866c794d
SHA512 0701089d2a3cdc43df83a5ced158531c0fcd4b360ca25ec94b96710032aee1ec093fe7641802bc4d305e1286e956d78f53ad44ccb7b962c72f697fafa42eaf96
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 90503cc068275822afbf67867af53fd266ee8cc9a3d4eaa12c778d951ac57b0e
MD5 4b99081777671979cd2f2ff64685de3f
SHA1 d2d798862b7928414e4cd78a3cb8ddb549391367
SHA512 5033f2cc6f29e00a5313f29c3b35485a7b0e4de33b5d0cf97522326ae7715e8a4266ec8edfa04dcbbdb5bf2a7895626d603f3ea5853e62fff2c2b321b92098e1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEU7ke2RU9Iz4+OblfBhDaO:A9iIxuERzA83h09RZxYj7K94/XDafEB1
MD5 SHA1 SHA512 SSDEEP

Submit Download