hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n[.]exe

Resubmissions

07-05-2024 16:42

240507-t7tjzaeh9s 10

07-05-2024 16:12

240507-tnt2dseb4v 10

07-05-2024 16:09

240507-tlvj5sea61 1

Analysis

max time kernel
456s
max time network
454s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 16:12

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe

Score

8^/10

bootkit persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2412	GoldenEye.exe
1964	TCPSVCS.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
126	raw.githubusercontent.com
127	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	TCPSVCS.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 948938.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE\:SmartScreen:$DATA	GoldenEye.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
116	msedge.exe
116	msedge.exe
2492	identity_helper.exe
2492	identity_helper.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1964	TCPSVCS.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe
116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3780	116	msedge.exe	84
PID 116 wrote to memory of 3780	116	msedge.exe	84
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 2756	116	msedge.exe	85
PID 116 wrote to memory of 3128	116	msedge.exe	86
PID 116 wrote to memory of 3128	116	msedge.exe	86
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87
PID 116 wrote to memory of 4956	116	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffabc546f8,0x7fffabc54708,0x7fffabc54718
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3896 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,12874925494281661777,15655338561156049222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Users\Admin\Downloads\GoldenEye.exe
  "C:\Users\Admin\Downloads\GoldenEye.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  PID:2412
- - C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE
    "C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of AdjustPrivilegeToken
    PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ddc1b6598e0ce5b60b20f52d6dd57913

SHA1
a7a8452e15139231bdbde00e21f31562f0a4e72a

SHA256
9b2d254a27932686bdde2b32eb4bb07862cd568a666b7fcf0ff606365fbad7e6

SHA512
0ccfb11deaf8b9eab93b44c0afe992f79f64bcc8a6302da931edcd9d7034eae761d446cb706da3a503a0f8e29c6633f23087eb6e6c8da88a333e27efd41dbfb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
f5efb2cf9219179700770c056a06e17b

SHA1
f821ce0477c2d948f59e90d4e75db6900b1f5f23

SHA256
159439d953aaa2a0e3226ddb534e5d7c96cf304d4b8e92e62e3c91354526ccdf

SHA512
c8a717e42bd30e0fb9b2cdaca6142f7e048fb8133b0168d0f53748bb60cca6ed5ee6b1d26939f7206b033e307bc000e521a5e399aeee1017d8e5ea7856897a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f6bd7cb256838154aa08814f5a0c4d6

SHA1
324d4cfe8b18a1cd47bd7a4cad69dcf244b0d4ba

SHA256
11335f16400ba7e3951ca775da2de052fa809037606f3124de2e67158ab38cc2

SHA512
057a9256f83d33ada81ef36f9a3cbf30be9fdd349bda18b7eaf1587269f0ebc0f467bb3e98699db143f4f43c538ba02426c3b6fecd23312e44ae4a07675783ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5eec43c87362d9ee88db9e062108c81a

SHA1
3f26145ace8458f1410c1e824abcef30a5a10e3e

SHA256
a9d3552d2af7691a1395bf6b93ae890547e855bc0e9ca71e11e2e54c0943326d

SHA512
0d8017462d8fcf6d819050f4b0960bc3c02bb2bf39c33549611570542dd1ba8fe2ca86030615b99a4df1408574f66c670c56bff89be6fda0a86958320c4013a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2d10eb614e1b68d5dbfea156ee0bff3

SHA1
dcf8b8888f6e12d95a0a4b4bed7c8492818ccec7

SHA256
863da2b701ce42efd04c0f83a5131d468d417db947be1c8bd91e6d6b34e40f64

SHA512
131a868f0520a1544da601562f2645f65a95f9a6dd2aa4281f10770a5a8c53b37245fd0e3aecaf40d4ae2fc7d21d6bf684480c8dc386fb8967c99e8a22bdaed2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c69bfe98e3d2e911f300265829b8f44

SHA1
0e94e11a064f23b188a873f7017d9166bf536231

SHA256
3242e39809ccb49bfde5b6141464abf3410066aeb82a56e93fd88cc918f3956b

SHA512
5becfbdab32a32a465acd48488d31f1373bda9ad222828bcd20cbd4c7d115b1ffaaa48acc81cce478cef07557903833194dd529dc599738bbf2c26c4a429382f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ac31eb8d64f1313a8d8c0d75b2222833

SHA1
820c5e16510544c443d0eba9c0dd674bb2c308b9

SHA256
59ef5ae6027099fc8a008de0685656f079808f4e9204481a799eb7b8e71cedb3

SHA512
4b3a12d93b58be1637d96622441f8eab635909f0334d8c9e1ea3e7ab0fcdbf6b85d664eac11864601a849fa086b0ec9f39f79607bd7d5b6a2baa1a2f0cd15de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e1664.TMP

Filesize
874B

MD5
e4c849f03c598985b29d0d895c2427ba

SHA1
dd1186fbd384f07899dfe27c7656d629c57755e3

SHA256
651e3ff8316f41b131f1ef50a302ae22f9d4c1c32a0504d704046efc7764a6d9

SHA512
d8511846d45bf5623ad3a99ecf8e9990b24eb38befd8300bafb4bd04aa764e9f7d9a7a295b3a1f5d5950e11c88288fb8059707deab4961cc5c28005c9bc180e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
96b29cb5b850d7c3914db59819e3b516

SHA1
87d9fcb5bd840af20224aced03964d5cb5094630

SHA256
5cb3486461312212378f6ed882d8aa9ff78dcb047c54527c85836832e85d8d9f

SHA512
3da1a95e2b762787f58a7da9a7a6cfd4b33fa6009f8fd32b64d9307d2445ae3658fb2e1274617b2d20100ede17be1a1d64b92f23e1172e875c9aca2709066604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5844e137b860297484626a9036d538de

SHA1
06a1ebf24d607b92edd5f7a5b8ea360645bc4c9d

SHA256
4d3707dbf6eb729ecd4f00e6791f821ebe2ce6d14e7f812f42de266937dc6173

SHA512
2eb29d3195776ba4bb43bbb43173beb376c616e90adbf01240dfc25fd6f5ab5768203b402d7ae7c9c5b4e80d39a4669dbf5fe03f58072db56279e772ebc9672b

Download Submit
C:\Users\Admin\AppData\Roaming\{669650f0-f572-4069-8d10-e63d89a91f72}\TCPSVCS.EXE

Filesize
255KB

MD5
caa4ead7fbb1e3305ca30f0a9e5f1e89

SHA1
fb7d71798c55d1a863e409c17be9bc5bda36299a

SHA256
abb05ab1a33efe24b4c5370995ec39b5ba5b2eff8fdc7f004edb9d864276582c

SHA512
21b745847c2cb4c6d54bb6467d552d19107c98a5f4e83949871c8ed5762f2db91f42c2e12cd06230fe0efafbcf9196ed3e0fa72be393bfd90ee25af402e5f01f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 948938.crdownload

Filesize
254KB

MD5
e3b7d39be5e821b59636d0fe7c2944cc

SHA1
00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88

SHA256
389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97

SHA512
8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads