643ca07224e075e20fb81f4462bdbbca04c61891329e275544b5a117adfe0005

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe
Size

921KB
MD5

3dc426881aefe72a44fa70879d615317
SHA1

520897c55fc8a25e834f7442243464d99d73c64b
SHA256

643ca07224e075e20fb81f4462bdbbca04c61891329e275544b5a117adfe0005
SHA512

8584c26b61824f29f09905d7aac20e3acabcfab160e2506dad8ef5d2bca632b225830d8c597ab8d61ed524054b696bfc8fe43d8758cf347a80d66c69166e1779
SSDEEP

24576:XaGo7wr6HAslncJgpy2PsaeF//s05pOsp:LqAQsCp4/T5p9

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Wine	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3624 set thread context of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe
3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe
3508	msedge.exe
3508	msedge.exe
5036	msedge.exe
5036	msedge.exe
4620	identity_helper.exe
4620	identity_helper.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe
396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe
3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 3624 wrote to memory of 4556	3624	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	86
PID 4556 wrote to memory of 5036	4556	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	87
PID 4556 wrote to memory of 5036	4556	3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe	87
PID 5036 wrote to memory of 1564	5036	msedge.exe	88
PID 5036 wrote to memory of 1564	5036	msedge.exe	88
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 4888	5036	msedge.exe	89
PID 5036 wrote to memory of 3508	5036	msedge.exe	90
PID 5036 wrote to memory of 3508	5036	msedge.exe	90
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91
PID 5036 wrote to memory of 2852	5036	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffce7d346f8,0x7ffce7d34708,0x7ffce7d34718
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3605679303423689627,12225785208548063257,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3dc426881aefe72a44fa70879d615317_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce7d346f8,0x7ffce7d34708,0x7ffce7d34718
      4⤵
      PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
80aaa2720a17841a413ba76e45e5a42c

SHA1
2dfbc3c0f366f28485c2174104f4463c32e957ad

SHA256
46d31d9c10738c60331c4be8bf91c37f0fba3c4e9ba555ddb68a30ea4838791e

SHA512
bde635a735325aec0cb50b5171a46df1ab68627961d7828a7dd8943cc02287e10f5c8db3e167125562cfecc7c2e4d70dedf0de557bb3d4608eea5ebef93c33e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ffe258f30146e58467f5fb1aba07f24

SHA1
2ace59f4d1ed1a8abb1028a40b74168eb390d71d

SHA256
2e181efe5c16e9ca6635ad109560f34312669cae5757eb9680b26fa5e70a7938

SHA512
99b42b55e2377860b3e7207197182e1bf016b9b0557f1f7ace6acade51c3548c61796789cc045310c348c51bdebe17d47e6b3c6c4f9364e87a8b6b5a8e30d169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a60d20415fc3aedd8c43d0b2ec7dc70

SHA1
4af5bf692f02198fae06a44454caede9c80ec127

SHA256
3f10730ab5a34a0a4476996832d3ca701d1b4b2ff07d262b20d74b4244c4f634

SHA512
d50333c186a0e01ba4f8bbacc0888ee69b9ccb3feef28a5cb13b20c477aa98641f3d4e832e3168c076bb81bff2033a862b41d2af057793fd2f1d1e2b019c6665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83ceb741406222d8dcd8d32253af78e7

SHA1
062697c6a59b7a4edb203f2ef6d3f8e2f8235f9d

SHA256
7082d6bacb035595af5a3dee27eb8269e1ba05319ea073d02ab09ffce2a5ddf6

SHA512
64417796b963dfe403931830ab0fb86c254e0e001d66bc2a5b443cdd97df8d2a45a2974de78db1931b139c83db02ae385164d2058c571db2188b984cd848a8bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
bb09f3f893d710672e57a0421ca061c7

SHA1
bc6bf81b006a68d39b1385492f1e55220a3e848b

SHA256
e15ff7905e9b145799e2d36576fee0c07fa3c1d441758f7767861835aac1f615

SHA512
ce61589c1860f82401e3a7451d7098c0ee7b82c4fd7a0d87718d7630a1d974f2894c8e12d4de461f959b30b42ef64eace913d31bef301900844be37b68dd8d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff8e.TMP

Filesize
371B

MD5
ba5eac2f10b40cce3fca2c0e75a0ee51

SHA1
db2bdbda6b6432c1b2f3d2a97d96f99b3c67d4fb

SHA256
f1c8dc81c62e59ae6e1fb30c2cbee504589a09e8cd34436fc87a6cfb14b5c440

SHA512
b707f09cc76459f5459a11970b86888ec61f97a6a4c73348010a6421d79cb1edbe5cfdc4138bb014d0ba1238700877eb2d3ad99b50d2f81c03149716206c51bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d92d4e00d135b618aa4bf5531c9585b4

SHA1
4331b6b5e2985bef0c4658a60b5fec0c0363ce8c

SHA256
2aa3919e9621542a687d62b9ab777a04eb0bb4bcb146ed0244d64d4c93cd64b6

SHA512
c91eb48617346ca66567ac49ec52daa2e6e1d6bfa81df710f661da58dc1b2b2e26653dec5f356fc3cd59a43561afceb06469cc09eca1162f45ee452b380752e9

Download Submit
memory/3624-0-0x00000000775E4000-0x00000000775E6000-memory.dmp

Filesize
8KB

Download
memory/3624-5-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/4556-83-0x0000000000450000-0x0000000000519000-memory.dmp

Filesize
804KB

Download
memory/4556-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download