d5781a7d6713602b72e0672725be22bb19f8fb62edc1193e232ef2f802ed11f0

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 15:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20f6595703412c7528964c787c9452e3_JaffaCakes118.html
Size

24KB
MD5

20f6595703412c7528964c787c9452e3
SHA1

3c51bf2d840c6e502ac3fa63db338a750ec20ca5
SHA256

d5781a7d6713602b72e0672725be22bb19f8fb62edc1193e232ef2f802ed11f0
SHA512

112fa67186c72dd401fa70ec22c649bc02a8c3efad83dc8a773944f0e68a9db6b8ea5a54abe0345755ba3e550bead2ff411f55e8978d3e74f69edba3aa72800e
SSDEEP

768:vbUDC7wFUeBq7f7K8fpM9LqqhXkPRU5Iz2Oag4w:TWURf7xYbh0PR6rOag4w

Score

6^/10

motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
phishing motw

Processes:

flow ioc

72 http://btc2016.atw.hu/index.php?welcome

flow	ioc
72	http://btc2016.atw.hu/index.php?welcome

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4440	msedge.exe
4440	msedge.exe
2508	msedge.exe
2508	msedge.exe
5332	identity_helper.exe
5332	identity_helper.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

msedge.exe

pid	process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2508 wrote to memory of 2652	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 2652	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 812	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 4440	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 4440	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe
PID 2508 wrote to memory of 388	2508	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\20f6595703412c7528964c787c9452e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff855746f8,0x7fff85574708,0x7fff85574718
2⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
2⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
2⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
2⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
2⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8432 /prefetch:1
2⤵
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
2⤵
PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
2⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8952 /prefetch:1
2⤵
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8268 /prefetch:1
2⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:1
2⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
2⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8852 /prefetch:8
2⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8852 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1
2⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
2⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18368840322831279000,13799413910658734665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6404 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
8eb51a1393c5f2b570a87fe249415a98

SHA1
3feb9a74ea3470442230d336e010efb186765303

SHA256
106bfef7c4117d14b34cefdb8ff560cefb2113ba5228baddb3b2fd054496611a

SHA512
31a4b69df477d24568c3b3f58bb1ef4f050e01bce56f76c62ee318dc61bb2ce191050bdfeb6a9af5e73382d852237d11ff43896334179b87824770e46f96cfcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
510aef7f1b8ffe3a34f16832d673ee92

SHA1
5c08527b08f84a6a0876e54aff56a8062029a4f6

SHA256
1560da920d5e09773d376aee0c0f08f2c5905659577a92116397e4774e508bae

SHA512
2c76068138c4aa775066f51c81a000cc608472d1a0c3d6c59757f05f4c8babeb1e8854f408d6711292dc769ad26e4d8f87a448b860bd58273fd0763b7fd31d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
7894b8fe796408a4ee17971a513dc95a

SHA1
70a4fb7a425f563662ab3ae4a7438af64c54eae4

SHA256
61f11d164f235ace9967d064813b211e16d2dbab8612134ba0fae5666e9de46b

SHA512
8ffe70e1762ec4bc660386acb08b982730bec7eddb1e733f920f40c378b77e9ccaedfe71f80dee51de3659a112d6b42377ff26c88a333347464ed85343b4e05f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7c51cd7db2605f09f5b75b6fd76b5a34

SHA1
457d4ead39adfb243cc867cc0284cda3d6b2062d

SHA256
5cd65585b15821d6281c938a9dcafc795f45d882ff83b0ca3e73100e813a00d0

SHA512
5b0261ce0b9de6cd3566df0508ff39118422d3da3b69cc737c21eb5db78973c29da3939fb6ad153f0914beaea6e346fb64827e72c282d2ac1441a8042e040c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
d63c0f2ac8c41965974b6671457a7b8d

SHA1
ca5d0e73e35a72c727198cae86edaf7ad2e183d0

SHA256
f543b48a68258012ca5324439e921a4ca958a2a83eda5db9d2c6dac0f44ab3b6

SHA512
76b8ccfa1f20d17627b37c11695060ce02ab5ac8b3ab0321745a9afa2fe14d89d7837e34ae520ed3b9d30a443654cab79abcabb256c0ee189817c46aa455b712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d594c2ab96925f3bc1e31649d184d65c

SHA1
2ad8055b57c55d6e41e9a17e26e1658e791b32d0

SHA256
a8535306eb6958f479304e6b799889946b4d00ead1da4d99d6a7145288412337

SHA512
9e216020f4701a191793e263d00f8bd07df884c081e53493e0195e1a02feb655c0869e9f8981ad295ba41474fdb539108b1a586f379c1db906cf4a7d6d6ef19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
9609eecd8930bc0e50fd31b52498f5ee

SHA1
7506159ee63f4dff395a5bacc3a7ffbee6c0fa0d

SHA256
18c6bf59c361f6d0dc0ce39a553a6a6f9be8a3c761de0ed29c5317564d56eb9a

SHA512
b3518dae1b0834c941992a8809374b4a0a257cb15d4769385c43e73b883e020dd0446af96577fae19329e37862729616bd7e23616a3d17fa995eca0a388d8115

Download Submit
\??\pipe\LOCAL\crashpad_2508_RHZCPTXGZUPYKFPB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit