d286e463da62e4b5583462b26ff57a5551c28a487a60ae574b9b3196ed26d98e

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f896545aebd19b7d3201ee42facef87_JaffaCakes118.html
Size 127KB
Sample240510-rmvv7aad4t
SHA256 d286e463da62e4b5583462b26ff57a5551c28a487a60ae574b9b3196ed26d98e
MD5 2f896545aebd19b7d3201ee42facef87
SHA1 cd69da299b5d301b24ee866df910493b9da390c4
SHA512 b6fb51cb1f0619d10fb46ae78269f3f42696ae2ad514263ec44913234d069b3528a65177b0439eb82fc0479021e542788a1ec6d05b4c0f7cd27688ef6819942a
SSDEEP 3072:w38Njz2S81Ep2slbbk+21yOVleByTPBXJ27/P7UHeaA2d61NY:48R+1xkLM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
2832	msedge.exe
2832	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2020	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2020	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1872	2832	msedge.exe	82
PID 2832 wrote to memory of 1872	2832	msedge.exe	82
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 2364	2832	msedge.exe	83
PID 2832 wrote to memory of 1012	2832	msedge.exe	84
PID 2832 wrote to memory of 1012	2832	msedge.exe	84
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85
PID 2832 wrote to memory of 2852	2832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f896545aebd19b7d3201ee42facef87_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae23946f8,0x7ffae2394708,0x7ffae2394718
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,1227486912117209086,8525927159648009485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b4 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 16KB
SHA256 7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d
MD5 01d5892e6e243b52998310c2925b9f3a
SHA1 58180151b6a6ee4af73583a214b68efb9e8844d4
SHA512 de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319
SSDEEP 384:MGx2krkLfYLu1yss2Hi3o0AkVAAdIa1pBz8OMD1:Px2k4LYi1pH4o0AkVj1z8OY1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 8b9d57afecdde70933db82f5fb0614ea89765cb69f4c4cc4920d3f637617b829
MD5 168f4fd61a88aee1c062e1d42878a82e
SHA1 4be221b533b65eef78741212684cca309e0296b7
SHA512 6725bd386d5e5763bdf095cf654cda33efa537fac7d7d481514029405879c396b0aab2dd96465c86a12b59846ab1a0be15e4cc2aaa56d196f1dd02f6cc935be4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 cd2c1e5ac7eccc4d423d1a981f8b8977d25d9a0f4f3b2bd595f3563460b457a4
MD5 2c5d8ac3e962ed77c694c8b724f312b7
SHA1 6f3c1755a72f50376a032d2d0c8f4a32b6e51262
SHA512 62f7b39c3aeb73a3ece811dd407fdfb6d4049f36956ae2421458aa9ef9efff35bb9fb9627c396900559515c07404d82aaa38d2cb9437a1c1525ec07e9fc93fb8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 2d1a12d321c53b1927d3fba7401c2af3f515f46dbd8d53ecde102d914a8a2330
MD5 fec23167aa02b51f66bc3899d855dcb6
SHA1 ab5155bcf8124f35fb4471cdad1f0c44ff1c74eb
SHA512 b6c1f6ac82e56adc0c7c2092290d42d60793fd7774d4acbffb4ef75875b25d5d12a7701f561f21e5e12dd29c02094ffb18e973db005456d91b07b17d7514909e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 59a06fe8df66ed342d71d14cfcd6c58e72ba8914deeb33c887904fa5d1bcc9a9
MD5 22c1e71962a2852d075f1b8980ff86df
SHA1 cba59b3391391bd93cafb720610b25c92516d6ff
SHA512 aaa261bb737c69ecb875859b0466352c36d06fca7e75afc88ad773316b318c2f73a5f4d0fcbba05122fb5ae823e9a94cb7a190f5f431b221d37bd5e68c619b8c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 b71926c882b541b3185d2137cad70b2aae04274345ab9d8fbcd2b42d223a1306
MD5 f4a05c2213ecbb17d12cc4a8ebcf23a6
SHA1 54f069fe655d8168d7e51d457705efd62f9cb972
SHA512 3591923bf8ab114fe7048b43be36fbfb5e3ec6295a380f7746338ae3d4958d35b8c86eb3dc9410408306fd4eecc7dd3fc00dabfa025c7b7eb15f87bd49b794a4
SSDEEP 96:J1jpTTtiyCiOkokis5tsMGgoGgjGqKF+GO9GdxGicGdMLGfkGGerlwi6GGHP:J1jpTTtdCiOkokis5tsMVolj5++N9s/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1b9194b3cc571943f0baddd471af03f867731ee2a3042eab1af685457425359e
MD5 f97a2289a1bdaaade071398e2bd8ad4b
SHA1 0b8417df7e9c838e8b2bfef3858e765a5999a83c
SHA512 a641c8bbe156fd89ca7eb7aa402b5ee9ca61eccc3a650c5c68869dad56b1427f72515ce33942ff378718fd4b36511a39bd584c04a0f3c74000cad12a3c2af5eb
SSDEEP 96:nJk10B1yv3wpvWMoiVmdeHplwtKacWeUWQyV+VDCziEwb:nJkSBYvGWMXpDXWero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b3ba101431d0d77227e7392032e37ece85a88ee987a3a3ba856e1e334d5d42db
MD5 3a7f1ba518d679de0dc6353d3ba9b1fb
SHA1 768abad3b1ba3041bd06f76538bdbd7e060e9d3f
SHA512 63d7942023313eafb74ccb31675914d1be4e9b8140143bfa84667913db5ab544fceccb3efa84ab5099082b1aa2ddb50b275ead78b7762edd3abb6ab69104b6e2
SSDEEP 192:nJkxBYvGWMEHeli77+CrfxKFmdRbIwJWu2pDXWerV:nJyYuW1yWa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 5c342c86e0ad01292d160e7911613d84b9da93d57dbb00b1ff11c5c91f8f0af2
MD5 28d4105ceb43ae040029c0b2fb16c991
SHA1 8c07d9e43e60c37dbabcf77a5ee841fa67542a3b
SHA512 3b0e69d27a4f258dee0133ade714f85824c86420483927a46f959d3cef9a0b26a8d223f6658c72a644389919fc76e06110365e85f3541720d280dedd01849aaa
SSDEEP 192:nJkRBY2GWMEHzeli77+C7aXfxKBhDmdRbIOY2cJG6Gu2pEcXWerg:nJ2YHWAzzWv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 4f0ba24a74dcd6e7c732bc2c4a3cab043115cd40152d54ac2d00e0d32d097b08
MD5 6da9aa06d510f1cdfb57db2498a1e09a
SHA1 2f7aa6a5365498bec44d59198985fdf7d2dbe111
SHA512 a2b5f045b8b80dd70b9ce14670b92babc90779578bfaecffde586bf9be6c64fd6f25ba7a344b02baf2c87e713c9197ee185d7e5e680eef1347b7471dbb29e96a
SSDEEP 192:nJkxBY2GWMEHzeli77+C7aXfxKBhDmdRbI2cJG6Gu2pEcXWerV:nJyYHWAHWa
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 0c7bfc0dfac8b4af62f15a0b28c6505d9c2e450fe2d9c1112deebccd649146e1
MD5 fe96424d0d6f3bea22dca29b52a01d75
SHA1 62fdee755e1f9647e14be8b5e7203170da9a6513
SHA512 3b951bf126c39a6ae26b2168bb976202a16d2cc21592d963e42fbd511f61f6b56db4b0350ff03e354bcd1fd44b6a24ef9d7f0f8c630a1f421fa15788b0de7d83
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d9dc685ebe0b84fbada93904b7fb77e6aa298dbd35132529aa6cc254da720b2a
MD5 acf4cd0eb92a09545d5954c3e1257bf9
SHA1 ac527997f8c85dbe33d3f5bc3172418f9e4a28bf
SHA512 49e66ff759fd222d6cc2fb7699f3daac7ecc09f02d8fa10bcf27edf4b40feec49cf40aee59fa615f58a6e600c88d78ae05c6987e8400131990c1dc9c6cc7d899
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57bbfd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bbfd.TMP
Size 538B
SHA256 62b8be547487c68263fa62585cb22b1f2d7b78162f8897d007f89c18c6b91dad
MD5 cb198d56b193492d79c3d4295af0ada0
SHA1 83287c363e3bb899abc8a6e85461d8f53baa3807
SHA512 4a07f45b7f8df552c52a46d40b8b9a17654b5e62c70a816c79a8abc3f0af868603436a941ef7fdcd91e42641577dea44b40f0e8e051e2082bfe3f66c59c54011
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 939044dd8eed06a9846ff0b50b21eda6e1e1924cf3c749e0dcff18f2aea156b4
MD5 a7c3361cc6eeb9eaa025ea7dd0cf05b0
SHA1 1e8d711a332235f309d192e63a79113e083497d1
SHA512 086c010b429748f0d71f1740aaa42c0c952ef8872c3481f42a3840afd3052b8827ca3bbd71e86bc410d98ca3b72955fe637641812c0dc22aefae282ba568d8f4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6Ae2RUMqr2Z8+OblfBhDay:A9iIxuERzA83h09RZxYhHqi8/XDafEBB
MD5 SHA1 SHA512 SSDEEP

Submit Download