605c30e41e7547abe5272a51f8e582c77b75f1b1ebbeb4f6617966ebe0111d1a

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe
Size

904KB
MD5

7612a94a3405a1138fde444018f062e8
SHA1

bea38dc13156805bfa1f845d12dd635de7f2c40d
SHA256

605c30e41e7547abe5272a51f8e582c77b75f1b1ebbeb4f6617966ebe0111d1a
SHA512

9621342a7512e799411603fbbf989f414b32c285c0294486f18f8fc839f0c84025c3434c74a751d6b6f110ac1063e591092e4b258abae81e335a58d8e7561fc9
SSDEEP

24576:BZcNqxXLtaWWeaVcUhQOaaM2K8l5dgdsLcvp6o6cBMqp:I8JLsW5atzxlPgdsLCv

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
3632	setup.exe
1620	s_install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s_install.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}	setup.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\ = "toolplugin"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\Implemented Categories	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\Implemented Categories\{00021494-0000-0000-C000-000000000046}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\InProcServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\toolplugin\\toolbar.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DFEFCDEE-CF1A-4FC8-89AF-189327213627}\InProcServer32\ThreadingModel = "Apartment"	setup.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3632	setup.exe
3632	setup.exe
3632	setup.exe
3632	setup.exe
3632	setup.exe
3632	setup.exe
1732	msedge.exe
1732	msedge.exe
976	msedge.exe
976	msedge.exe
5264	identity_helper.exe
5264	identity_helper.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe
976	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1804	javaw.exe
1804	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 3632	3176	7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe	85
PID 3176 wrote to memory of 3632	3176	7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe	85
PID 3176 wrote to memory of 3632	3176	7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe	85
PID 3632 wrote to memory of 1620	3632	setup.exe	88
PID 3632 wrote to memory of 1620	3632	setup.exe	88
PID 3632 wrote to memory of 1620	3632	setup.exe	88
PID 1620 wrote to memory of 1804	1620	s_install.exe	89
PID 1620 wrote to memory of 1804	1620	s_install.exe	89
PID 3632 wrote to memory of 976	3632	setup.exe	92
PID 3632 wrote to memory of 976	3632	setup.exe	92
PID 976 wrote to memory of 2748	976	msedge.exe	93
PID 976 wrote to memory of 2748	976	msedge.exe	93
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 3220	976	msedge.exe	95
PID 976 wrote to memory of 1732	976	msedge.exe	96
PID 976 wrote to memory of 1732	976	msedge.exe	96
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97
PID 976 wrote to memory of 2712	976	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7612a94a3405a1138fde444018f062e8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe
  .\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe
    "C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xms512m -Xmx1024m -jar "C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ipanalytics.de/c/linker.php?lid=SrdJWqxHbk
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce17246f8,0x7ffce1724708,0x7ffce1724718
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 /prefetch:8
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,16334355474779731524,18071954849650729125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
a4e22d60b909ace7b197ef219ede4af3

SHA1
516c7c22dc8d71105076d87464870ead6ebee37f

SHA256
4f86933130fe3603ae74a41131747dc0d5ee9c26168228d91ff5ab120f29e57f

SHA512
ac4fc3cc6a27264d77fc8f9c2eaec03602aba27567333a9b81e404bc3f59a1708fd7fb52ed973f34b369b6c12efa6782ee562b642900381db4ef9d317b197469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e19a6b2e84b6c005c90ed7ed1ded02ff

SHA1
fac9053ffc1abdfbde65d96ab07e821cb519fdae

SHA256
1caca5a2852f914b0330fc7acd92596f9cc89a3aa25ab57d8f5ce69ad4ea8546

SHA512
64bac413d66675dbb83b6659751f43881cb23aca3a3f1cbdf5461b72065f2411ecde259cd330aa3062de949df68f38b72d879ed25585f0dd64427e64df319734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
280c2b8d6dfb85b82b7d2c780f41e898

SHA1
28acf2cf0b86dd0090b3105de95b75b63c1e13a1

SHA256
88ad1d46894588852899fdbef54268f1129803fed10a906f4baff4e9def8719d

SHA512
b10fa7a501d26d2356e472d08b944da47254f947016750251d80a993f7ce6d7e397fa2943ce42a5c36888b4608239087df32207f044a8ab11c84b0bf20c6cf53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fa7e73dd1d4768fdf68fce5734e8692

SHA1
c0d2e4100151b4074fe122849a73a47723db52ec

SHA256
40ce49f3f0661ec0af813ab2357bc95aab8999d45a125f5149f6a90d21254756

SHA512
5aa163800942df00f4700a95bc09edb90ca45f8411331df27d09e580f5855de2531019ae941f9f061f14163e87db10e4498e56ece5384988a33451a9a5830e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9ef5c4dd13e0600cfabe432a48ada1a

SHA1
84b49807eca2abfb1004b951faed2776663c7b39

SHA256
5b7d7b64ba3e791205456c78a854e99541eb88f0a5f54104b38d41bee504e77d

SHA512
51b0e888811463b2c4b244ca8252bbd9840ee4bd1d3f7cc2af87722d70e84347c37fed26efc5eb4efcd7cfb8bf236eab922c05085c75ea2ade09c47455f51dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\options.txt

Filesize
119B

MD5
fe03bbb0503140a48333084f376b0daf

SHA1
b5909c98be01391e826bea3ed97c42f2c9d62384

SHA256
f45fddb770daeff0c1acd0ffb16c2277b767b22b1e86c470776387e738e51704

SHA512
6d73cdc4b467b13ee86c1eb0bd165f498826d6f55c663adf50bc00bae0f5902cde21ab94c220a5298e0a93122441d8abcb3736e30aa226f6bed89ff9a294437a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\s_install.exe

Filesize
263KB

MD5
0f1931e26c21219db1c90e90037f11f6

SHA1
74b65f7fb7fa197d413ba5bc45cf10304deb4ecc

SHA256
f4d54e35b857b5dfbca6fefcff5ab5599ce30b62eef7deded6594c5be93d25c3

SHA512
0c6a90034e5852915af61ccc091568cb636f583d4c4b5cca8bfc3f7f86bbf6a79f16c324d723c1d3968d7996071bb85a79cd6fde682bb4bfeedfd770b7b8e817

Download Submit
C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\setup.exe

Filesize
666KB

MD5
34a53701f595d002fa8b65655f41e6ae

SHA1
11f29f4c7836011cacbf201b0057c079a831c31e

SHA256
68b403e06f0d9dc2e776f82167fd4bf2e392d271533d091cb826f4dcb3b7b1df

SHA512
180afc8c738dcb09d233700b2e43be3d8d5a14885e7940966ca85e1203baa76a4d9a383299e6da278f0b02c963c9845ab41ba0277f5da4c46230f6bdd4484339

Download Submit
C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\tools.dll

Filesize
615KB

MD5
3c3c80039c6d346f75b15d8a08754ce3

SHA1
57e5cdf3ab2b37471613fa343cd113870f26c75c

SHA256
54e34b0c0e294b474630dc0b282c4b8904b3b5697c7891248fc2e0185688d91a

SHA512
c089a7ec8459bd20c319f98cf375f82a49db178fe40d7a0edf3464ee73bff42df47364ee0c8a3a9b4277eba7f35544e139db7948e62ef6e5332689f0c8fe17e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.Admin\user.js

Filesize
391B

MD5
ee411ca5f47f3f17be491c7900f59cba

SHA1
a2482c3416ad6ebfe41113edf2e2bc07c9866a1a

SHA256
4d36d11c560cff3224c8725cb3db1d8c88316c8caf16f13ce866970509f7a0ec

SHA512
27ffa809d9030959be3e8f004a3b2bc4902aeb33b5f64781225dca8f4c97075d0b268f6c5335c64f5656eef3063a2d8c5e084f56016b9930f73b6ff01c597351

Download Submit
memory/1620-31-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1804-86-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-114-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-121-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-137-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-151-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-152-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-135-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-176-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-199-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-115-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-90-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-74-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-47-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/1804-42-0x0000018146A10000-0x0000018146A11000-memory.dmp

Filesize
4KB

Download
memory/3632-11-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download