396e045e7252529e118b81d0e329a8488c679d0b3b5e9d6e545e2a755774db74

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6970751fb1af5ee4bc6fa9867229b0e6_JaffaCakes118.html
Size

54KB
MD5

6970751fb1af5ee4bc6fa9867229b0e6
SHA1

cdfd2109228a3d25406494d368dc9ebf920de5f6
SHA256

396e045e7252529e118b81d0e329a8488c679d0b3b5e9d6e545e2a755774db74
SHA512

96f94d19ca5c4bc45272876d273ae6865b500193b779730825d701010efef4dbbf202958bdb695eb211bccd9fd9fd1a705f2bc45634493bb962d79911712e4f8
SSDEEP

768:1A13ErsOyHHvPWxGcj9KJ8c0OGBmQ2dvYDWs8GTTtvU29rMRKb:fs7HH2xGc8e9qyHntvhqk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1612	msedge.exe
1612	msedge.exe
1672	msedge.exe
1672	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

Processes:

msedge.exe

pid	process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1672 wrote to memory of 4088	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4088	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 4744	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 1612	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 1612	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe
PID 1672 wrote to memory of 3752	1672	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6970751fb1af5ee4bc6fa9867229b0e6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb649446f8,0x7ffb64944708,0x7ffb64944718
2⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
2⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
2⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
2⤵
PID:616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
2⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6800 /prefetch:8
2⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6800 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1112 /prefetch:1
2⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
2⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
2⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
2⤵
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
2⤵
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
2⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1272 /prefetch:1
2⤵
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
2⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
2⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
2⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
2⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13030976929750733062,15886424791783402662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6840 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
20KB

MD5
9be780bc06907ecbdf0320d88e6da1d7

SHA1
5af34c97da84ba9319b4b8d6e63352eb9299bead

SHA256
bf111ba484d1fe1d7ebd0f2c1e3e61a844008abb17383c81610efa5f6ceccc3a

SHA512
ffa99bc96551ce59af822011cea136142aba10ea600760012ecc3bc5391dbdd3269e365770f4650e9de12fae39cad2a6f11d2e70a8c3c73ef17cdd93b2fb1822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
35KB

MD5
93dc978c37a5609936b0f1fc54ed56d0

SHA1
5a56bd6d22a1a83828e20e932f21c5c99694c981

SHA256
e2605333cdd7d3ac773df148499bc612285e13d3f97e659687988406120d69cf

SHA512
4f5860e3841cd3955c911a61391e64e2b1895ba10fdf2156d816755c4842f43d1b2398fb83e53145a841d2a955a1ecaa4ac620cc5fb0f5c7c0ff6b342e4c5e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
54KB

MD5
3d43ad52a5e97214b6780973a555d0c1

SHA1
ac5dcc5dbafe9781453c87ee892c8769cff3df25

SHA256
2760b7d22f5936561faebf3afcec848f31faab71bf5c95243e36908178d33342

SHA512
e117dfd48a35fd897b052e4623449bceaef0b9d9742ebd078b36d6029743598e1a91c81c0f984f0b3e2b81ba02bd6613c78db6f477ee202374ef94bacf48b2f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
50KB

MD5
acf8d975b08abd0df7238bb3be2b8447

SHA1
4008ae77b1a295f9982f2193fed5189a0f45f0c4

SHA256
c3e1017596d24df7aa5f9cf6fd00fc0721453a5c18ab77b263f56cf82d2e73e3

SHA512
22d19a06fe35bf489dc7fcb159aa47d51dd4aecbff8bc1d2f1a41fe284f6308bdeb69ac0b64efc6f1552449a0c59dbdbf14d9bdc9d77bb1e31eb41a7962c909b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
18KB

MD5
c9ed731944024702b435ba1cc59ef389

SHA1
80ed46e16bd892d709d35f5ba8dfef01e4d6e320

SHA256
34b786e8399cc681809345c8e92d95927bc67234f4e592adc1ef2a5d8e4ed449

SHA512
679fa2d9cca8f8e2ebd5b7fa94243cde17b166dae8267849af76736b84e48a420b49446d77e36672bb6ddb8daa8f994c1fffda4388224e4e3ad5a149da68885b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
140KB

MD5
85b757d4ab2a97df06e6fc1f0e11a3b2

SHA1
3d03fc14498c6339417c0a28acddc557e3b2b102

SHA256
565235659e9d002d52e2c0dd1d1327aa8e1b9333d21a14298206ddb3b4cde58c

SHA512
d873033acc917a1ce7881e14e58c943e1dc207ce0e350a5416585f6831ec80eeedf7b915ca8720645dcc0af1709901a4f003903d4dcfbd3d3cf199dacff5bdba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b78608b410f9d8cc94925f677b155057

SHA1
b626dc20a83cfbd67d84e048674974d3f408e5f3

SHA256
3a8a34b177dab6120da2f8395c5c676071577897a6e47cf17134db9c87242858

SHA512
25dd6e7a6a327b4002d6e7e3d9fe8cf1f1c821a3ddc37bb41da84bf54a049568e3072b74249e06c93412ab6c4ca8f99351865aa699dbf61df502cb5248a24207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1984faac0cf1db5be5c88f09e0b3435c

SHA1
2b89ac594a15ce4028fe050f67ba6c7387a098f5

SHA256
b6b54d86afe18f2bec32e9a4604e9618b5a0d3318332d352fe56b4877771eb69

SHA512
94375daa7d1b398b71f4b106bae768ec2c5290143501f8ff67bc96bbdc1cae1cdfe81b078542109f28cb4b83cd8b16f5ca4b1c57a82ca9343f70b24e8c5b2218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
369324ac0436cb6c7ab163a4c68b7496

SHA1
e1eb79f778ce2c791e3ec32608104c17aac4df26

SHA256
9f9db4bef6c6b4c0e8d489b2f63b5c24c06ae92100adb3a86dae91ddd487d658

SHA512
cbcd75485d4b233582e038c12d84246b236e59571b15ba08b716985bd266e2288d6d983802bde473adfbaf1501a3170d00353bfc91dd8a74d363911aa8e27f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b8e10b2a109935272aab4d016f7a1d9e

SHA1
7a8333cebd9d963f0c73b75ff42346939fe56377

SHA256
664b5f08ba439a84911c8b324968d9f2a648d6cd53bae0c2b4eb2dc70e54115c

SHA512
ebceabf66a352c785ae78b7d664f2a1040d6ca4c41f7c37adc8096705d812c94f88b37deef2e481b1913b1ce00170d091f65f630aeeb2d45d130456febbb0586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e9dec30d9fd77a019dc7a7f6b7f29934

SHA1
b5ebdda440a24c5fa1b86fa385a015d1ca114790

SHA256
bc14b6d92a90953da48cbfcfdb2f6c0a110e4dcb0253556db51ca4e3f7947c74

SHA512
35ebb0cc6191e9ebec5735c033fe5fd2aa8f31f6f973d39f77c719553d6d7cd6bcea3630fc2c768a2188019535181446a71089420a5fefd6ac7fd83e3d832f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
293eb5ae83406f934ca9685a80c91e62

SHA1
c888a578429d4306d66d698fa528f976f6708300

SHA256
6a4f14e1dfad7cef7464fa7ea74e5ef5206a48c02b50a5ac96ab2f8aaada4278

SHA512
2d1b08f2e282a76715c16f55e5aa359386a4ce61fc698b4cf07aaae4438c24266a1ea4f2c0b49a85a1d5b54df517f2fc123a5447199161a2c3be80b9c3b9635a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bb1451eb075a3b2d70b9297c111eefe7

SHA1
84de8022b1d377757128add0982fe95d59d6a7f5

SHA256
d9d13757f453a3fb2f1378b15eaba06fd2e38567fc84ceb1058e48c41acf6a1c

SHA512
6aa1538f15f6bffcc309cc872b4bd370ad44a4a79642c8b0668dd2d180f73f65b66cb381887a9e8d02a7c78453fa1ac8052cd6580e8ab85e3b26e7087d17a23b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cf18005c3fc3f8cbdb8defc37e681301

SHA1
712e750fc1d2d25293521116f932144ea89f272f

SHA256
c77f1b178edf9feded45c2a7e45b63d4430a4a33cb54660a2a7ab40bc36e9475

SHA512
25d8bb6e8b71edfcd231e51c53dd34b25288b6ffe3939962a08a778ef2fffe99dadd53021566491c921085aed285eb458ebc896f345d991b8993dfa946740ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f77d78fe3bcab10aff5e198f5cc7577

SHA1
af8821ae49c1b4fd0f15d5cb5b9162dac7296d54

SHA256
bd7ad3324ed007b922b7789d5e65102b7ef54803e63b1be1e908301a8cad7353

SHA512
8aef4fb288517a4a1f1bff62e114f98177c0b708fede884e10ccc9eff0a648539abbcd26e661a52bd8b16df78e2e2a4263e11e8142e47aa5ecbfb5be831e459a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eff830c466d2e0ffcaf3a37a4a2cb1af

SHA1
aa4c92f4481012cb9dbaee699dcaf6bdf1606fa8

SHA256
51becf5400ef3752855c2ee61e6fd76658d75eccc9d8587f18075b7fb01ed148

SHA512
2abf3048c2d657707b5f88cafff2ae30f9743406dc8ce428151e16af356871feca3c10fecca875e91c296b50ce2b38f585ebe1544b84d5d9b22689e9daace966

Download Submit
\??\pipe\LOCAL\crashpad_1672_FJRBCOCUZQDWDLNS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit