a8447302ff987a59ed2756a58fcc1475ea5b65ed687e2a5837a8cddd96d4cb16

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe
Size 76KB
Sample240621-j63q5ssfmd
SHA256 a8447302ff987a59ed2756a58fcc1475ea5b65ed687e2a5837a8cddd96d4cb16
MD5 0a76da90eb89355db247387d806a7ef3
SHA1 6bc5abd6b54a9ac7a0adff98a7ef80b913a5a068
SHA512 03106970787bc7269964bfcfd5e3c737ddc8ab2e5951f2317da8a1062c2451b3a643b220f37e8f4bb8eaf7040c6ba9b44425e7a66473768cea5eda819d56cbaa
SSDEEP 768:jxDI8Nwl34ETcpcbCgHjSJ070vvLXmJuBGNgj5mMjI1t0cT4qf7hOZR6f6I:jxDXwTQcbCg29nLXcu8h7hOZRhI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
5076	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\habt.dll	0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\habt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ = "_IBhoEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy\ = "IE Story"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\ProgID\ = "Gorpy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ = "IBho"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\ = "IE Story"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer\ = "Gorpy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\VersionIndependentProgID\ = "BhoNew.Bho"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy\CLSID\ = "{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\ = "Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\InprocServer32\ = "C:\\Windows\\SysWow64\\habt.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\ = "IE Story"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ = "IBho"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID\ = "{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ = "_IBhoEvents"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
4964	msedge.exe
4964	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4964	4740	0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe	84
PID 4740 wrote to memory of 4964	4740	0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe	84
PID 4964 wrote to memory of 1368	4964	msedge.exe	85
PID 4964 wrote to memory of 1368	4964	msedge.exe	85
PID 4740 wrote to memory of 5076	4740	0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe	86
PID 4740 wrote to memory of 5076	4740	0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe	86
PID 4740 wrote to memory of 5076	4740	0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe	86
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 1660	4964	msedge.exe	87
PID 4964 wrote to memory of 3972	4964	msedge.exe	88
PID 4964 wrote to memory of 3972	4964	msedge.exe	88
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89
PID 4964 wrote to memory of 2112	4964	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a76da90eb89355db247387d806a7ef3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hotvid44.com/bind2.php?id=3913367
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb5bc746f8,0x7ffb5bc74708,0x7ffb5bc74718
    3⤵
    PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4020 /prefetch:8
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,5970197679689947132,5804781183297147044,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\habt.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2152b41d6f4027fe807023702e79fb81f40344316208caeceea8b196e3e50cb9
MD5 374697a6ed7559f2bc8c8c3bb234a63d
SHA1 3b67c0d9b54c996dd92de019b3e6b69c8bdf8e54
SHA512 0ee6630ba774daeabba3b08be157ae3fb407cae6bb6e23e5e00aec6ec1a7efbf79223352f2079c45f498da9d2eab79298b3244928a9c3546187a108e271330e5
SSDEEP 96:nykVO7m1BW/wpvWMoiVmdeHgia5rUWQyV+VDCziEwb:nykvbYGWMXaFro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ba96483329a90c39af53cd5951832667d8eb19c79ad96b94a26e89b4db537508
MD5 649594fa54ab51a5075ec0f193ce498d
SHA1 d54b566fe33e0e207bfff24b0fc1830b4ca4cdd2
SHA512 0e062d8c4dd7f483d37dbe3a12ad2f1285783d1b9342056d0f084f19a876a83f228125481ca28870f5d90d52c21e5140279c4983b513fc5c83a12d97d4bcb6c7
SSDEEP 96:nykVF7m1hW/wpvWMoiVmdeHgia5rUWQyV+VD7AiEwb:nykKnYGWMXaFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 072027457924273e0bde3f81b062c1ee994081db809265ac61d3939078bb4a9c
MD5 df3191e110e1d011a2dcedf3d1976f70
SHA1 292340c99a403b25cf74d06c032e9e50c08a7b86
SHA512 d4fd9916bd8d4beb4a977e27f287e34192a780065ac855b28347cd834b17456087aa91b36b7b8be3291cebeb5ed8a4f2c90ba9cad9ec61747da33bc107180db3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGhe2RUGc2kG3z2OMDCRHqF:A9iIxuERzA83h09RZxYG10GaOMWRHqlr
MD5 SHA1 SHA512 SSDEEP

Submit Download

habt.dll

Path C:\Windows\SysWOW64\habt.dll
Size 52KB
SHA256 a221c8b0bdbce003df66f7bed5236b304980f70a297ee85c56f94ed1dac67c9d
MD5 f6a2a59a84cd7d3bb109ad6acdd7ba39
SHA1 c0dc3e9ee183fbe659830d8b65791f6dd993e668
SHA512 f1d2239da5562e1f8a9fb089077288d1c0bed0908bd669a5638e97a6c874bcdd0bfc48b1be2a77837f984465f4a50bb17ca34291f1e0f97ac49f14451ebf3d7b
SSDEEP 768:hvvLXmJuBGNgj5mMjI1t0cT4qf7hOZR6f6:hnLXcu8h7hOZRh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4740-2-0x0000000000400000-0x000000000041A000-memory.dmp

Download