d90dc3f22cc7bd92f22bafa9d77b0e373849386eae57606b42239f915357084a

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe
Size 988KB
Sample240617-3qe5paygld
SHA256 d90dc3f22cc7bd92f22bafa9d77b0e373849386eae57606b42239f915357084a
MD5 ba278ec040eb5df044a5baf5ca95fb2f
SHA1 2cd4a508be34ec1be76e47c6891bbfcd579bc9b6
SHA512 9e1a4d7c8af370a625e11703730dcc599a5a8622f876f14d41b5678f014da5521944758847f87e96c8e89224272060d2d07ec37ad3b8b78040cbcab5cd9e7eb2
SSDEEP 12288:g5ZgdOO/46Dn2+wtP4KuHOWhEaApq0SMFqYOHNhBTgfikOL7pHvjJ5Jw8q1Dfkla:gPE/ytHuu8oSwe3BTrfJrvO8q1Bf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	regasm.exe

Executes dropped EXE 1 IoCs

pid	Process
4620	NP1.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Travel = "C:\\Users\\Admin\\AppData\\Roaming\\Terry\\TPO.exe"	regasm.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 880 set thread context of 2436	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe
880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe
2436	regasm.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
3304	msedge.exe
3304	msedge.exe
4432	msedge.exe
4432	msedge.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2256	identity_helper.exe
2256	identity_helper.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe
4620	NP1.exe
2436	regasm.exe
2436	regasm.exe
4620	NP1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	regasm.exe
Token: SeDebugPrivilege	4620	NP1.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2436	regasm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2400	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	84
PID 880 wrote to memory of 2400	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	84
PID 880 wrote to memory of 2400	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	84
PID 880 wrote to memory of 2436	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	85
PID 880 wrote to memory of 2436	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	85
PID 880 wrote to memory of 2436	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	85
PID 880 wrote to memory of 2436	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	85
PID 880 wrote to memory of 2436	880	ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe	85
PID 2436 wrote to memory of 4432	2436	regasm.exe	87
PID 2436 wrote to memory of 4432	2436	regasm.exe	87
PID 4432 wrote to memory of 4284	4432	msedge.exe	88
PID 4432 wrote to memory of 4284	4432	msedge.exe	88
PID 2436 wrote to memory of 4620	2436	regasm.exe	89
PID 2436 wrote to memory of 4620	2436	regasm.exe	89
PID 2436 wrote to memory of 4620	2436	regasm.exe	89
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 4164	4432	msedge.exe	90
PID 4432 wrote to memory of 3304	4432	msedge.exe	91
PID 4432 wrote to memory of 3304	4432	msedge.exe	91
PID 4432 wrote to memory of 4720	4432	msedge.exe	92
PID 4432 wrote to memory of 4720	4432	msedge.exe	92
PID 4432 wrote to memory of 4720	4432	msedge.exe	92
PID 4432 wrote to memory of 4720	4432	msedge.exe	92
PID 4432 wrote to memory of 4720	4432	msedge.exe	92
PID 4432 wrote to memory of 4720	4432	msedge.exe	92
PID 4432 wrote to memory of 4720	4432	msedge.exe	92

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba278ec040eb5df044a5baf5ca95fb2f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
  2⤵
  PID:2400
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"
  2⤵
  - Checks computer location settings
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sar_Senapati_SGSF_Ltd._11.09.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb7be46f8,0x7fffb7be4708,0x7fffb7be4718
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
      4⤵
      PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5124 /prefetch:6
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14789727115084139188,3804548595348635171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2
      4⤵
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\NP1.exe
    "C:\Users\Admin\AppData\Local\Temp\NP1.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a4c4158e29faa636aec3985f8ea9d6578f8ba5fc0ba48e02e7df9789ee0f564c
MD5 31512b8db8e800ec7fdf768fe7031a06
SHA1 3c72163a378057375bdf5c6d9f16b585a9c24cd1
SHA512 46b96d3822f192e3b4be56d5530590e43792f4d764073fd96c112737ab5624b22946f05e1d7a41d8821acf3115d83cf535ef911218b11a23b0b0eab0aea6b6b0
SSDEEP 96:nUk/oxm/DQYmqj13AvwpvWMoiVmdeH2WfFUUWQyV+VDCziEwb:nUkBI4uvGWMXVUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ac605a5d5f08bfe55d1b7866b53ad16fc85771c1f2cb397159f3aa0c4e269721
MD5 f4cd8b804b681ac2b14caa16350bf3df
SHA1 9f684667ab79765eb0f156f35b2287b14a0cc054
SHA512 8fd820e1829b08f2f68fbafe0e0c18cd27e54a3479ad633735f17b9c726f86029cfe392c7023a6d83caf122ed194f425a7cee1b70481fcc686b82a85c997dbc8
SSDEEP 96:nUk/oxm/Dnmqj13AvqpvWMoiVmdeH2WfFUUWQyV+VD7AiEwb:nUkB64uv8WMXVUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b74e4f00ad524fac45ec09568352032a853c33d58379885fe1c60da1f29c5c5a
MD5 08b538678864e6a524cf8d12f0ce6d27
SHA1 f114071ae6556e7199b5e6b2786d540b5e64805e
SHA512 745857690e4b95f29bcd1c115b88094eef6e5c723f67c3bb05e2323f605e5e3fc28bea79903000f00077b9cde926e71fe21068d34052bfeaaf3498a2102ec59d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi5HfKe2RUC/h/r53z2OMDG:A9iIxuERzA83h09RZxYi1MPVlaOMWRHF
MD5 SHA1 SHA512 SSDEEP

Submit Download

NP1.exe

Path C:\Users\Admin\AppData\Local\Temp\NP1.exe
Size 10KB
SHA256 c2cae82e01d954e3a50feaebcd3f75de7416a851ea855d6f0e8aaac84a507ca3
MD5 f683769b947501b5a98376619d5938bb
SHA1 6a38e4acd9ade0d85697d10683ec84fa0daed11c
SHA512 dbd7a26139c5ef6a409fb247b08eb54c62328edace9a047aac3ca75b8e552572428dbda4efc7836398fa4d2d9e68075e10e2436efcf1f9fc138d69ac440bd556
SSDEEP 192:mvzBCjuwu5VxWX3CLhKruIIW1YPhziQDaOTCKnw:8z86w4IUhKru1hziQmOTCQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sar_Senapati_SGSF_Ltd._11.09.pdf

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sar_Senapati_SGSF_Ltd._11.09.pdf
Size 78KB
SHA256 615d36ea54f42ee5ede68d7dbc5a07fa112b6b6a57bb2d75a70181c21c15c8cc
MD5 388ef153194af2f17a70a82c0f65ce8f
SHA1 00e6684fecd83d78d0d1123e591ed10abe2c867c
SHA512 b6423b046ad56a354bf34ba2f6adb55a6eeaaf51883007b41eb0717c161125ab8dd591a07a0975db4357db63efa05035d24ab01183da276c1d41c6d18954b236
SSDEEP 1536:jQ9b+nCG6oB/q96AJjhCYaojXulQZAuufXJUF7mL6Cub5zm:jQJ8FB/K9TTuCzoXu7g6Cudm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/880-7-0x0000000002BB0000-0x0000000002CA5000-memory.dmp

Download

memory/880-2-0x0000000002420000-0x0000000002515000-memory.dmp

Download

memory/880-6-0x0000000002420000-0x0000000002515000-memory.dmp

Download

memory/880-3-0x0000000002BB0000-0x0000000002CA5000-memory.dmp

Download

memory/880-0-0x0000000002110000-0x0000000002111000-memory.dmp

Download

memory/880-1-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/880-5-0x0000000000400000-0x0000000000494000-memory.dmp

Download

memory/2436-8-0x00000000742B2000-0x00000000742B3000-memory.dmp

Download

memory/2436-9-0x00000000742B0000-0x0000000074861000-memory.dmp

Download

memory/2436-10-0x00000000742B0000-0x0000000074861000-memory.dmp

Download

memory/2436-4-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2436-80-0x00000000742B2000-0x00000000742B3000-memory.dmp

Download

memory/2436-81-0x00000000742B0000-0x0000000074861000-memory.dmp

Download

memory/4620-31-0x00000000742B0000-0x0000000074861000-memory.dmp

Download

memory/4620-32-0x00000000742B0000-0x0000000074861000-memory.dmp

Download

memory/4620-82-0x00000000742B0000-0x0000000074861000-memory.dmp

Download