Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/05/2024, 10:59
Behavioral task
behavioral1
Sample
StormKittyBuild.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
StormKittyBuild.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target StormKittyBuild.exe
- Size 366KB
- Sample240512-m3ndtsca5t
- SHA256 3106f3defd63051dd4652582b58c1f030c102f5f6e49a10e3e008df6e7a27fc1
- MD5 1afedad3b668e4bd8faa5f2d7abda95b
- SHA1 99bca8ccac242858184191f64f5da874722442f8
- SHA512 2b9eb2ed122e20e82148c2243d25376cb44008d91a2bda41922380955a532fe827503b527d39b3aa96d8a0cd85cfdc942c23203b87568d292313c203c499c0c0
- SSDEEP 6144:YxAcUJjuAxKzHlnoWINqzbv2Q9rUsbf4l35PKMxQpHUO6dUIY8u4eU:djuzBoD1Erf4lpi0O6yR8uK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 2 IoCs
resource yara_rule behavioral2/memory/880-1-0x00000000007B0000-0x0000000000812000-memory.dmp family_stormkitty behavioral2/memory/880-2-0x000000001B2B0000-0x000000001B338000-memory.dmp family_stormkitty - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation StormKittyBuild.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 23 raw.githubusercontent.com 24 raw.githubusercontent.com - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Delays execution with timeout.exe 1 IoCs
pid Process 3732 timeout.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Kills process with taskkill 1 IoCs
pid Process 5108 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 880 StormKittyBuild.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2052 msedge.exe 2052 msedge.exe 5024 msedge.exe 5024 msedge.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2384 identity_helper.exe 2384 identity_helper.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2396 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 880 StormKittyBuild.exe Token: SeDebugPrivilege 2396 taskmgr.exe Token: SeSystemProfilePrivilege 2396 taskmgr.exe Token: SeCreateGlobalPrivilege 2396 taskmgr.exe Token: SeDebugPrivilege 5108 taskkill.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 2396 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 2396 taskmgr.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 5024 msedge.exe 2396 taskmgr.exe 2396 taskmgr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 880 wrote to memory of 4260 880 StormKittyBuild.exe 92 PID 880 wrote to memory of 4260 880 StormKittyBuild.exe 92 PID 4260 wrote to memory of 3360 4260 cmd.exe 94 PID 4260 wrote to memory of 3360 4260 cmd.exe 94 PID 4260 wrote to memory of 5108 4260 cmd.exe 95 PID 4260 wrote to memory of 5108 4260 cmd.exe 95 PID 4260 wrote to memory of 3732 4260 cmd.exe 96 PID 4260 wrote to memory of 3732 4260 cmd.exe 96 PID 5024 wrote to memory of 116 5024 msedge.exe 101 PID 5024 wrote to memory of 116 5024 msedge.exe 101 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2344 5024 msedge.exe 102 PID 5024 wrote to memory of 2052 5024 msedge.exe 103 PID 5024 wrote to memory of 2052 5024 msedge.exe 103 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104 PID 5024 wrote to memory of 2584 5024 msedge.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe"C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB333.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3360
-
-
C:\Windows\system32\taskkill.exeTaskKill /F /IM 8803⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\system32\timeout.exeTimeout /T 2 /Nobreak3⤵
- Delays execution with timeout.exe
PID:3732
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2396
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1660
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe5c2046f8,0x7ffe5c204708,0x7ffe5c2047182⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:82⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵PID:516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10633591717865550157,5367371661374113638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:3592
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4848
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
- MD5 4158365912175436289496136e7912c2
- SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
- SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
- MD5 ce4c898f8fc7601e2fbc252fdadb5115
- SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
- SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 8d94df83db5e39a6a15bd55010e40d7b35913fb202a885c4730dd05d8e14695b
- MD5 709d12a35e0f675ded99ec10e4cadfae
- SHA1 73ff189bcadccf636fae665e17398d86a8781a41
- SHA512 433d57e28b00aff96cdb9b4d7caa19a8303a7c109ebb69e05630cc3df5b4a80b752dbd4ff84ffedc1e732d77ef816c647f03425a55807e3f735fd44130ae91b8
- SSDEEP 96:npkXxm/pQYmq41rO8juwpvWMoiVmdeHvSSgUWQyV+VDCziEwb:npk8CXk8juGWMXuro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 31a6ee35db07950eafe9fada50d9eac343c371e2854a66283a808d625050d049
- MD5 e13ae4a5b412e1c6518e1499fbff61cd
- SHA1 948f65bc27df4ffd213314655c67036f7da5d0cf
- SHA512 ebda84a5cbd96e0d40a6d6d99da6992c4ba4eb4ff53e009441a1fc6dd215b4ca11da3389a13c12e70da495342bd992ea314a146dabdd7932a2e2e8f2605abcf2
- SSDEEP 96:npkXxm/pnmq41rO8juwpvWMoiVmdeHvSSgUWQyV+VD7AiEwb:npk8wXk8juGWMXurg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 ce93d1c51e8725955cde0e952b61c20d68a9063e95c99db58ea9f87dbd104820
- MD5 a0da075953fc8b89d686458968949841
- SHA1 09c41d53523e5ff0dd179c9f6112ed3349830747
- SHA512 49d54f5e87bcd25a126bb5c98e93daa5b5f752ad480d2ff487fcb83efc546b05164148dd8c2c45b364864b246643e9cae4201550f2517bf634ff63071c3cd936
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU8e2RUY4up+OblfBhDaavF:A9iIxuERzA83h09RZxYUixp/XDafEBEW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmpB333.tmp.bat
- Size 243B
- SHA256 7c63a9caa8105ab453bd563098a0ce4a6175b0443ffa25108dbe61bee5f8467e
- MD5 0dfb3ee6aa8773ffc4045dca83195a76
- SHA1 baae9e5298d86369869ff0da649ffd2eb3a49ae8
- SHA512 a0250fe59e96627dbe8a8d3cf1a74db6e8133d250068d2f5e8456aee8707f56f4e247358927d9bc06a29f0cde1143de366caf60d4ad1e77be6d5ed87cb029328
- MD5 SHA1 SHA512