8f6065070b9ffd1f46692aa281efe1092e073a72297a2c828632c43de7eb66cd

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8924d6f8f3b0945a046368e9571ea4ac_JaffaCakes118.html
Size

288KB
MD5

8924d6f8f3b0945a046368e9571ea4ac
SHA1

a0eaa159dd8d0320c8f67e4f0fe2735ce5f58c13
SHA256

8f6065070b9ffd1f46692aa281efe1092e073a72297a2c828632c43de7eb66cd
SHA512

405c8fc795c237d1d7246a2f73c3ba2005c45ae8ba04ce7ad563136c0d049cb2bd01d7d8553bcaa72a7aaf72fb34e4bbcacd3a5db8033eaa780280f360a5d916
SSDEEP

3072:wNF2tTxAQuOth3gDYQSV1H2geTTgDkAD0bUwHmE4UESqtmo:wNCTxWjDYQSvgo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
1884	msedge.exe
1884	msedge.exe
5332	identity_helper.exe
5332	identity_helper.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2756	1884	msedge.exe	84
PID 1884 wrote to memory of 2756	1884	msedge.exe	84
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 2372	1884	msedge.exe	85
PID 1884 wrote to memory of 4136	1884	msedge.exe	86
PID 1884 wrote to memory of 4136	1884	msedge.exe	86
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87
PID 1884 wrote to memory of 2528	1884	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8924d6f8f3b0945a046368e9571ea4ac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce08f46f8,0x7ffce08f4708,0x7ffce08f4718
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8316 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8228 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9284 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10232 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9272 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9328 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11875660541381040552,1458586013208674834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
7288fb03468c9d2fa003a6b58751a697

SHA1
788652d6b37b9d07b4953f09ba438e7ef7d6f0e4

SHA256
1cf2f78c5a8f3f77ac70496c65d0a42a5cb6b6abc6119c726ed69636c2ef6a27

SHA512
07780dda3f9370e9fafef73f4d49454248594ba9c3cc7b905124cb07212ee8e38ca978782c0a1157816836fb8030986cc318287b74d11d7a01785d1d19e6d2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
33KB

MD5
54285d7f26ed4bc84ba79113426dcecb

SHA1
17dc89efec5df34a280459ffc0e27cb8467045ab

SHA256
b0754afe500a24201f740ed9c023d64483ca9183fa6361d759bb329462d25344

SHA512
88afabcad8dbb0f49cdea27c64783ec98ece295f139d50029d524950a5b40a7971f033529f7b60e5acdef5f0576bdcf107fa733bf439cc76693b654ebdd9a8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
54KB

MD5
8f811d9ef8787b0ab8a52c9792efd531

SHA1
9a23c1876eb3cbb030450922aff3b6106efaae4d

SHA256
93b3bd790bba7ba7ec1fa0ec4c83e4bb98d17e6cf75965b0ff27c2095cc70068

SHA512
e351131e942ac5e87cd10b4670ea51142326b5f6acc059ca15a65b5420e114e9dfc6ac91b4dcb1042e479dafe4baa90377067ec56bb8fa3df3abac454c9d84d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
21KB

MD5
c3a1bf5fbff5530f55ad9f9fa464f25c

SHA1
449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa

SHA256
4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0

SHA512
75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
29KB

MD5
ce0a426ce1e09f068caec06014c96608

SHA1
66cfa0bfe2b2a177683743a178a1d54d62a72ca5

SHA256
c9386f78a001dd7c580322eb66dd70b24ca35ebe80b7f513bf0250334036535a

SHA512
31049c4761f88bfb4f90e1271ff243c9fc6abc69c263a152345594f082e91aedbb394a3a7b20570cfc23df0a43a4b1b93df5e9a61fb222051b5acf27fea66338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a0c43b31dfb24280_0

Filesize
19KB

MD5
b20cc61748981ae7c59418b5481ddc8e

SHA1
bbe7265285da42be5eb5a19d310bc7de6ab66f69

SHA256
a1312e8dcaeb2d4fda1da4c6687878db59551231a2b16bdb66d1cc563413e133

SHA512
0a94cc21a447f20ef64cb86a94a1d0c5b5428458491a3f499838443e9159a3a7391cb6b822cc77b0600cfdc55bad9744017be78bd2e533375296eee86bcc2285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b6aa8349a1e741a7_0

Filesize
220B

MD5
00bc53c13060d8911ac80dbb281f308b

SHA1
84050e8ec537ab4deadd4e6e4bea3a482fc58b85

SHA256
fe25fea3378fb5b63c53c4da8116edf6c1bed8fde4dd78eefc02243be73bad08

SHA512
64a3eeb17a187ddb9f6c2edcbc629b55a3637e22a973c3619f17c9bb6465c649cd53793a224cdc564b6cf70ecb1c2470af5f505664882c9766ad8791dcd192ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c1e1f6a66fba5020_0

Filesize
221B

MD5
b5789855c194db8c8e732e036c107ba5

SHA1
73fe0363980d6cce8d1aa3bfcac8bcb8c3808af3

SHA256
f1eb7c2a095d82a8c14f53da80428fbaa5dd0d9f9db7b26866c4dfadf0bbafb2

SHA512
1f674b62c82e378f906f277b620314361e8bb13c06ccc94f401d52d15dffb188f734ed626842dc68e9be9e81142c4abd6949cf62a9780f11a7d2855fe240eaa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a61a4be6f7ca3a4abf1b7a99e0bbe0f5

SHA1
9b677d482ef8b2b16d0c1763d2eb7b779dcde707

SHA256
78f9cb7d1aebc479398915ae1b5221a7386f0e0a005c07bc48924a81c2e61502

SHA512
9513591d82cc2774f05cf50c19e05bfcd411d6c5fefbaab2debe9dfbf25a52e337e962771aa5aba3285dea49b8f4d77c3861b9822b2abadbbd2a65aadd24404a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
50300493730ffc68b67b57ee66e3a5f3

SHA1
a94185b7ff9825a4825e53c7ca8ee7399aca8b70

SHA256
c790a6a29d57133a3d338ecbd1a15e9f1e75be100e34b96c8f6502c96abea50f

SHA512
e651346777a296834e8fde95fd694796f6b2c583c9462f6df0622cc641070b8f7c3b1175eca71a9f67ddc5d41a5d3feeaa230975e92bd9d9ccf69a095bd05762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c6a4babdbee5dc6883f1a4ced0d3552

SHA1
d7bafa32b1c7b1954db74d0925df00739d25c227

SHA256
cc634635f9c166dc653d0e81d9d2549ee1dc28dbbf7cedd1597755c9face4cd3

SHA512
306c11fe5dc844682f0f06b3bdd03bb8fe7100a510b1efc3d2d852cba8ab1dd2565b3c7b6d098ecb3f58fac62e9bd542d1a64dad11e6d9c60e4b6a1e8c25733c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fa2378c8b50c2259bc9a5771759413e1

SHA1
e63918545bcaf0b007a27257adef082e2e3eb5e0

SHA256
d3236dd64f13761d534a7d21b1ccf985acf06d7b2bf02031395aab40602c3742

SHA512
2636708ba81d1c30d37755f87219c3aff7272546d64fba6ebd6f93c6d236aab782036d60a698e0933e5f8264a0942723e4881d0e836be2084d54d82374017395

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3a80d7a21e4109ed004dd123f95c3f96

SHA1
fb91b448628562b26c61744d586843aa8fcdd09b

SHA256
ae7fc24c3046cc86c548456c8aef6ce9b493145fcb21e3c18d26638503486f38

SHA512
2b5b3258a693418d5ff7c092ab00dedb76894d19055ad9993b4c0b615102af3804dfdd41bfdaf3e122ea2ebbc6ab8e57b4f83f2b92d87477c134e255eae69046

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
206865a9e22eb687d1d511c80d735d8b

SHA1
a4007cdc2192a908c239b4c7e8461ef75316c780

SHA256
70934a4a13088522b382ddf5426a7e018a7c49a5424efe1da290cbc7e7346151

SHA512
60608b6aa5e96d8a37f734e4ae57bd6d254bf1f6217c279a26657024c714afc7cfc4cfc83da34fe762e89528de22fe0ee3c0cd7e78042261685272d3184de454

Download Submit