3190c9fa940ba69953c8e9c153ebbf382a3dd08a36a4cca68b80baa2699d1c3b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d487b65075dedc7d064a896a9dc285_JaffaCakes118.html
Size

130KB
MD5

68d487b65075dedc7d064a896a9dc285
SHA1

b855577f08646f486bb7ed2f6417d69050be80b2
SHA256

3190c9fa940ba69953c8e9c153ebbf382a3dd08a36a4cca68b80baa2699d1c3b
SHA512

4f8c37438ae5df0fb3a5c94a99299c9be00e52677b46f324c02e5a42cca19308077e6236eeef214bdcdd99a249440a6ab1a689a0c12acd6d2bd79833d4b1604d
SSDEEP

1536:8EFwEzfTAknBQ7q+ONMGwjm2EBDZEqVj1AvnvoPK5+lk:l/LAX7q1NMGwjm20G01gnQPK5+q

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

10 sites.google.com
15 sites.google.com
16 sites.google.com

flow	ioc
10	sites.google.com
15	sites.google.com
16	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3700	msedge.exe
3700	msedge.exe
1172	msedge.exe
1172	msedge.exe
1284	identity_helper.exe
1284	identity_helper.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

Processes:

msedge.exe

pid	process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1172 wrote to memory of 740	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 740	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3704	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3700	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 3700	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe
PID 1172 wrote to memory of 548	1172	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68d487b65075dedc7d064a896a9dc285_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94e46f8,0x7ffae94e4708,0x7ffae94e4718
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8132 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14025663713376256343,2432934511355371307,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
01a72394f4fadcc6d35b91d602a1b7e5

SHA1
de63c8f2bb57d2e0dc8113dc605d1917597c21d7

SHA256
161765ef2cac6169bee40f12e134ef23b096e0e1740b5294f89e0bf140bc987c

SHA512
40c278fcf86a93042a0bcfc0a2ca1361475a6d8c6524916490345fc77133841a2c5828f42f142605bf9909b337f74691fff030a5559903fb534c39abf1cc200e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
0c85d17d5e6a117455f3554561782a18

SHA1
aed05411f91df56b5ab23ebc0fc1c33ede39b626

SHA256
13ba44f39895de972a11f4906c3728e27f31260dea83b3d0a19f837364f4c52e

SHA512
415ad8bb1f90f56bfec736dd23e42a42294baf2303788969115499941d7a6bfa169b2dae60b200cffb6a0c5e05efb4020ba801eba12a88d8047d84bf5a81e6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
3e5c43d57e51fbc0d45273d94352643e

SHA1
c3ec1d5237586d6337c07420910df308c7aff9a1

SHA256
8f5edbbe4bb696ddda9e4a07a05aada68322b2ef3767761c91f3986279a92d71

SHA512
e2c2b7016fedb090f5a1d62a73419a553188c22b84510a6ad21a1b4eec35f04d5033cf62a9c7d9ae3cb269ec77caa4fc988f7862031d491ce577d449d94ef640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
9fbf40d07f3c2242d801df99bfc77073

SHA1
4dd4dcc131e467e6ba275af2f4abd7bf430fc7f7

SHA256
1f7d951e8981493872157e1c376f23170e8fd529d5f791af2f7c4c3a044fd43c

SHA512
8287c319a6475dc355a01beb2ef7cc4354a6bd50995cea3eca6cdab8d4c9454a658d523571ee2636373c2fbbebf369983fb50e357328ef81600dd338d24d97b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
843f3fa04d95d717f563e5b21d336fc7

SHA1
2083f27ec208f98c961d0f0127072a45f24fb1f3

SHA256
c616a95cdf59f93f6379a9895d44b65e75c3fde0292cf7d1e8cf0b08e147a7c0

SHA512
115deadb5494d65568b21dd0db3edca6a582d76b2989522f49b68799afd51649008802a4183c00b977cb02027804f00f40d388c9236245cfa1eaff37a3fef660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d43034cb14361c98293fa58aefcc33d

SHA1
d129cf88031910feb474ea6ce04f0ae800616455

SHA256
edc72ef760621dd08465c636ff5710620d5e038534472bd7d03ea20351b23b93

SHA512
7ed024a28d0736861c077a990c735b509a70d43476a8c5298ddce82d559c649f65b448347bb76292d2fe6f6d496543a53fbe0512170f3c8040d1c2df9d679c77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
16c936d720abd37431816c2f9c94c350

SHA1
7c1f64a09d39fb0c69555bd9280278d7ae2eb8ab

SHA256
de8b069c550f79a9d64ae93aaecab8610124109a104daf518f5265329e168e8d

SHA512
b89f9af78d66e51a316d3a43fc7e9b3a5247d2d47f7fd97336249df5a2cee4da9d37d9224f9fb4e3af280a66f78899b7f32e1829efd8cd772a82ee07d9ef1d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8f7e0169cf103a89bc1610889000fe10

SHA1
88a20abbfd32f8ba578d803188093c482793f312

SHA256
fbe8c3f263f9dd3e06c3711e100ac124f40689c68bd03f807d4483d97a33d4cc

SHA512
6a7adf0aa3c660040bd026d6354350aad5a87933643c488b5de6383e0f08b61c501c0670df067831cd2caa22e9f2fbff5ec29d7dd62954949bf57bc04a89b8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a125ba03e03c3d0b6fdda994897ddb00

SHA1
6249c7d0fff6482812abd19ecdcccbb9c004b6e8

SHA256
7485d3df8e6be3a60732bfd777c47d31af2c92e1514f9c21479c806a1511c11a

SHA512
b170619e3452f758b85226d9c9d49139878adc29fe7a13af413213e35df5527707c151b28194b8e719a48c4e33070e2d73e7cbc45faad3c99254fa4122396e39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2ec5f90c9aebddc7f0fee372a6ad3abb

SHA1
9b058e50715421c3bc3be72fca9c5235261fe1ad

SHA256
55afef6f92c908bb24b13ad6ec93c1fbaf46c7bdcac540734b265702d688695e

SHA512
9ca623c824232ba5d7ce253e4de3201cadb065b9b42fddfdfbaf0d7ac11c9e4c7b51982494351e6e4dbeca229aaf394ee3e4e57335d3b2b2d02db1702c617867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb10.TMP

Filesize
872B

MD5
17d5073a04b3d3b9e2a633eb600a2824

SHA1
b2a795d2c9d4d73b7af348b7fe3b9e2193b7a87c

SHA256
300a574d8522ac81daf59666a3f2bfc3b7e13590e3875fe009982d2449f00d66

SHA512
5acf907a6f80a73a15db86ed8e96320412af124bd5c6f0cd780f76563c54d9216698e71fcfe328aa55c5298d55ad192055a0ad764a1125b31ae6cb0671c619e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f66fb9c53ef9adf3771c43c7962c990b

SHA1
095de1ef20d67e699f2dbe9a08785c62853dd4da

SHA256
752a00ca575ed31b92567036dad432b84ec3fe9d89153265b3e4cd4ec2e097f5

SHA512
5541ebc17666e3a0697e96d9e0d50714c4ea6589e05d1cb3a846d931d57bf7dfacdb017e00118da4f88fa312a259de190bbeed818efc015777699dfe70e72d97

Download Submit
\??\pipe\LOCAL\crashpad_1172_XMPZXXHBXKARJTAS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit