9daa64e20f7871ce0cb99a433c039471a61034b5a7ce70ca00dd766ac83ce8a3

Analysis

max time kernel
147s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe
Size 63KB
Sample240802-ewdbaavhqj
SHA256 9daa64e20f7871ce0cb99a433c039471a61034b5a7ce70ca00dd766ac83ce8a3
MD5 82fff7a33442f62e9b5c55417cbbc23e
SHA1 64189966be9b2c98df468f485e98b5a14ccce4e9
SHA512 2dd6635c18deda86e9fe1a6b156ee6ad4f82ec1d4ac9afd6ce91bcbe3c217ce4578243b985122fe1867f82e4ea60de0efeffeb3e0dfd7193ae5c2ca7e90507af
SSDEEP 1536:RPoVHs9KwtEoH/YskrTZ1h94fyHuVWiLAC:9odKmsk7h6o0cC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00070000000233f9-16.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2828	installer.exe
1768	mt-uninstaller.exe

Loads dropped DLL 2 IoCs

pid	Process
1768	mt-uninstaller.exe
1768	mt-uninstaller.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000233f9-16.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Win64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe"	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mt-uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1768	mt-uninstaller.exe
1768	mt-uninstaller.exe
1768	mt-uninstaller.exe
1768	mt-uninstaller.exe
2960	msedge.exe
2960	msedge.exe
4936	msedge.exe
4936	msedge.exe
3444	identity_helper.exe
3444	identity_helper.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2828	3096	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe	84
PID 3096 wrote to memory of 2828	3096	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe	84
PID 3096 wrote to memory of 2828	3096	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe	84
PID 2828 wrote to memory of 1768	2828	installer.exe	86
PID 2828 wrote to memory of 1768	2828	installer.exe	86
PID 2828 wrote to memory of 1768	2828	installer.exe	86
PID 3096 wrote to memory of 1824	3096	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe	89
PID 3096 wrote to memory of 1824	3096	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe	89
PID 3096 wrote to memory of 1824	3096	82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe	89
PID 1824 wrote to memory of 3240	1824	cmd.exe	90
PID 1824 wrote to memory of 3240	1824	cmd.exe	90
PID 1824 wrote to memory of 3240	1824	cmd.exe	90
PID 3424 wrote to memory of 4936	3424	explorer.exe	92
PID 3424 wrote to memory of 4936	3424	explorer.exe	92
PID 4936 wrote to memory of 4524	4936	msedge.exe	94
PID 4936 wrote to memory of 4524	4936	msedge.exe	94
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 372	4936	msedge.exe	95
PID 4936 wrote to memory of 2960	4936	msedge.exe	96
PID 4936 wrote to memory of 2960	4936	msedge.exe	96
PID 4936 wrote to memory of 872	4936	msedge.exe	97
PID 4936 wrote to memory of 872	4936	msedge.exe	97
PID 4936 wrote to memory of 872	4936	msedge.exe	97
PID 4936 wrote to memory of 872	4936	msedge.exe	97
PID 4936 wrote to memory of 872	4936	msedge.exe	97
PID 4936 wrote to memory of 872	4936	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82fff7a33442f62e9b5c55417cbbc23e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  C:\Users\Admin\AppData\Local\Temp\installer.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\mt-uninstaller.exe
    mt-uninstaller.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c explorer http://www.lmcimagery.com/stack.html
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\explorer.exe
    explorer http://www.lmcimagery.com/stack.html
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3240

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lmcimagery.com/stack.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbdc4c46f8,0x7ffbdc4c4708,0x7ffbdc4c4718
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:512
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,16163423837904560017,15862323956196432846,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d43f2dd4ac5b6ba779100eb8b84bc92fc8700bedcd339a801c5260b1bb3ce3bf
MD5 347755403306a2694773b0c232d3ab2c
SHA1 94d908aa90533fcaef3f1eb5aa93fee183d5f6ac
SHA512 98f1fb18bc34dfc224132dfa2a2e6a131b280b25fcb516fac3bb66da2a47c7a7061124881de6fa5f65602663dc0ea71357b171a3346bb1514176943438322253
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bff3e3629de76b8b8dd001c3d8fb986e841c392dfe1982081751b92f5bd567b0
MD5 ea9ef805116c4ab90b5800c7cd94ab71
SHA1 eb9c7b8922c8ef79eef1009ab7f530bb57fbbbea
SHA512 8c907d2616ce16cfe08ddeb632f93402e765c5d9430a46e90ab5ea32d4df0a854c6007b19f9b0168254ab7aadf720fed8c68d1a055704db09c1b36c201a9b3b9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1d8fd7bc8203ca82e767278cce2b23d707adda12714dc2ebfc81698e61d9fea0
MD5 70b3b92463344e9e91ece9595a17e796
SHA1 22ee442b11ff9aede58cf6ad8e83e9465762846c
SHA512 f59273952216ef8a796a950a8598af2c51eb1abfbf1c40c237f6a48239fcdd39042c849b3430d4eaa7f885021f95235c063d8fc43b5aa596d9ea9abe2c26186c
SSDEEP 96:n4kkxm/GQYmqY16NRwpvWMoiVmdeH5tVkUWQyV+VDCziEwb:n4k9fLANRGWMX6ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0a9a459d9e8767ab70e2c2c28bca759cc2232004a20a91b0c206d83c190cc88c
MD5 b22e467a01dcc4150da6ed6141c36c2c
SHA1 8a8c5edda569a31933f19194a56ead06aacb9179
SHA512 3d2a29ab621a5bc70b68eb41d17f7fc211ccd726cf2dd566844f213016f3b1598de05c1dbf21352396541bbfbc2b9498f06d738dba8f9af5d51ce737ca702483
SSDEEP 96:n4kkxm/G6mqY1qNRwpvWMoiVmdeH5tVkUWQyV+VD7AiEwb:n4k9GL0NRGWMX6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fa05a9f47212ae7c14dc898512f99a8a84dd1459fc11a39f057d2b0e0a7315a3
MD5 78202fde7e737dde2e26f8c8d71215c6
SHA1 d286365761e0653d7df6b8b8c25b3c78531850dd
SHA512 2030bc55dc87f1c0afaf2bf9db8e236f5a2d429c2913a21bfa3fad30cfe30c8fa42f8c7d8335f8b1b479fab86a0143d64b163cd0c2b4e85d0d526acf2fb81580
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzghuNSe2RU6HpvwbAs0KVS:A9iIxuERzA83h09RZxYzg8NsvHdK6KoP
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\installer.exe
Size 53KB
SHA256 15b9457ab8616ee2d918518811ed28b4dd9521082a731fac6e75ed70a0be2bd0
MD5 edb1479c55054bc8297007c69ba28fac
SHA1 55c1721d6c37a8f6b9c98653ecd831081210ede0
SHA512 ebe605eaf0a78fb5ef37fb9284d206d9ba04ba7702e298c73d9630739d33dcd6f4b056fb1f69bf702b605e21463fb5cc37f041f467352d4913dfb0a3c61ceca1
SSDEEP 1536:Ya0DHILgPRzsDpl1I70JQgBJNpMmSLoCgHB:gDo8PZ43BJsmS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

mt-uninstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\mt-uninstaller.exe
Size 50KB
SHA256 6f14726920917e8fda3af0bf1016811be0c52b3851fc2d2924455bf93ed105b8
MD5 02cd0535a0c1f4c5bbd5864bdb62991f
SHA1 a9c7617caeaac658adbdc948c5446b8b982cafd8
SHA512 b4efbbf317e086bf23a6d9ce9925d3ad286c5faff4ee03f1313a077d12ec4e7ebdb2b90affc3135528212adf8bae2e1c4fdcb85fdb7534c43a06752612d5c374
SSDEEP 1536:Oa0DHILgPRzsDpl1I70JQgBJNpMmSLoCgHBg:+Do8PZ43BJsmS6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

remover.dll

Path C:\Users\Admin\AppData\Local\Temp\nshA53A.tmp\remover.dll
Size 20KB
SHA256 a0e1ea1c98791f3a0a13d9b8bc055c8aeed1b72061ddce08af70bd1656dc1f00
MD5 91033a2366a455113e9b3bb74ea41f78
SHA1 2e19d8a03cda9877b9f508e3349be258c63e226b
SHA512 477f6f8bbb77496eae48fe3e26db9db003207eaa45e7f411b7fd34935a7acc27bf8d0b8ff8692d5d6aa54dc0784ea96ede1babe8cc1e4f37f3b65400c8909e3e
SSDEEP 384:EK1jH9+HHUOrtCfWPRXccBnlr+VJM/cwZ6xdO9gh3RZ+AK:vVH9bOrtCfiX55+VJgZc6AhZ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1768-20-0x0000000010000000-0x0000000010012000-memory.dmp

Download

memory/1768-19-0x0000000010000000-0x0000000010012000-memory.dmp

Download

memory/2828-22-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2828-4-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3096-0-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/3096-89-0x0000000000400000-0x0000000000455000-memory.dmp

Download