a420e3b5584da3ba8fc9a852226db633a0cba8e373d024f846ff9431a6f661be

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a915e3f54fa96491c025da5edffe121_JaffaCakes118.exe
Size

30KB
MD5

8a915e3f54fa96491c025da5edffe121
SHA1

f49f5dfc314ca0a68626d58ceb35fc21c76e0438
SHA256

a420e3b5584da3ba8fc9a852226db633a0cba8e373d024f846ff9431a6f661be
SHA512

fa21e53f6f5f57d3e254aee4e549bc2b50643fa72c0e6fa67809311701ee9bfe61ee51c6c18d04f45e901b72e961e46070afa20633ffe0cdaaccc84b202c27e2
SSDEEP

384:XAnwOjMmZUqj8s/6a403bgEoU4wjJNQqpjffcj0FJyY+DY1sMrZH0JbkUTM:wnFBZN6aXcsvjpjcgX21z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1104	856	WerFault.exe	83
3252	856	WerFault.exe	83
2196	856	WerFault.exe	83
116	856	WerFault.exe	83
2304	856	WerFault.exe	83
800	856	WerFault.exe	83
2980	856	WerFault.exe	83
1436	856	WerFault.exe	83
4472	856	WerFault.exe	83
2736	856	WerFault.exe	83
2884	856	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a915e3f54fa96491c025da5edffe121_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
3308	msedge.exe
3308	msedge.exe
4880	identity_helper.exe
4880	identity_helper.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3308	856	8a915e3f54fa96491c025da5edffe121_JaffaCakes118.exe	106
PID 856 wrote to memory of 3308	856	8a915e3f54fa96491c025da5edffe121_JaffaCakes118.exe	106
PID 3308 wrote to memory of 3824	3308	msedge.exe	108
PID 3308 wrote to memory of 3824	3308	msedge.exe	108
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 3084	3308	msedge.exe	111
PID 3308 wrote to memory of 4496	3308	msedge.exe	112
PID 3308 wrote to memory of 4496	3308	msedge.exe	112
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113
PID 3308 wrote to memory of 3932	3308	msedge.exe	113

C:\Users\Admin\AppData\Local\Temp\8a915e3f54fa96491c025da5edffe121_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a915e3f54fa96491c025da5edffe121_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 604
  2⤵
  - Program crash
  PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 808
  2⤵
  - Program crash
  PID:3252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 860
  2⤵
  - Program crash
  PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 924
  2⤵
  - Program crash
  PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 1004
  2⤵
  - Program crash
  PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 1204
  2⤵
  - Program crash
  PID:800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 1184
  2⤵
  - Program crash
  PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 1224
  2⤵
  - Program crash
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.tim.com.br/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc43b46f8,0x7ffbc43b4708,0x7ffbc43b4718
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2943145541052490521,11056220544667667308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 796
  2⤵
  - Program crash
  PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 1304
  2⤵
  - Program crash
  PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 148
  2⤵
  - Program crash
  PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 856 -ip 856
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 856 -ip 856
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 856 -ip 856
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 856 -ip 856
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 856 -ip 856
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 856 -ip 856
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 856 -ip 856
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 856 -ip 856
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 856 -ip 856
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 856 -ip 856
1⤵
PID:1244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 856 -ip 856
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1f44af048d6bfb216c530e107e50adc2

SHA1
84bf8389b8af97806b84cbff1d62b664916c8c07

SHA256
b756ae324695c64a4f67a81a39ed511fa753b42b3b1e57ec6bec2ce0387417a6

SHA512
6a11e2cfdbcb4cb00dc76768130267d850ec951c50877081cc8db20b221d02ccfff53c628b54a04820cc3f92ea9b8eb44f9689cfa796a7539a703c496ca4eca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
ee08cbb52bb7e06de217bf83ac50e6d4

SHA1
28a1709eeacc55ee374f302d50118a2a3285798a

SHA256
adf17ae0538ea389bcad0ff992e8ba811cfe6e0a7abc686e631b788e414f564b

SHA512
7a3c40e9c78dc3e36490fa6f3a02b11cafa52cf86aa986be7cfdddb986c3712bd1e14e333669e02134e048d094e3ded2fe7be3c91e3f4ba1b59dffb6b097c73e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3de27a2dd84aaa589c65894b306210f5

SHA1
01b7add76bc60e359fd50f032439164beac4a983

SHA256
fa5694b74f2551b2a4d4e453bbab8caa4f14a410ce7847bb4790040de7cb9ba3

SHA512
70c62c744656e10a2fdee937cc78dcd81d32ba0b3222929a62f2eeb25027e72b99a904dd680341fe4c9aaa7046678d61cfa96d3eb7153ef14257bcec5010407a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f395de317263e6c5f2a3e7b7dc28d0b4

SHA1
0e2459961e28ba1a655ac8da4e689add3201cb94

SHA256
45912bca1bbcd7bce3d00ce22c88e32cb03ac34543140ecd570eec81323afdb5

SHA512
104b58ee14f5192590d01bd0e969b3ccaed3b953da45a968a87a045f3585db1ffc7bb23d96a8f2908ac6b9b6108eb16fa161dcfb27ec845dd3306a8c8639882f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6aff982e3034c5e08f27b9b1d5161b21

SHA1
7c7da79e26f65370e2f952370fcbb06c89f42803

SHA256
d914baae812e9761884852babc904b64a14ae85316b7a432f7528d275f2d098f

SHA512
a4944f27c4330cd5c61c8037ea3b9809658677880bdba194e762f0785e43d9c8599f25156c47785844d356f00faa05871893e3c3d381161dae84f550d35fdc48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b26863c92a647caeb38f5d83cd188cd2f36208a4\index.txt

Filesize
89B

MD5
517a35789a8101cb3295f3e43aa2c77d

SHA1
386d1360550c2f00d7194327b343870b41379e53

SHA256
da053f558cf10559881048e757ec48714c28a2fc83439260b3ef11ca13e1d37e

SHA512
0e2b7c551e4c245a1f26a77c4ee84a3f7e3833e69ca9f8ae84549ddc3d17b912622bc8f1b22ebb5c95db504266affabc12aa2fa379e517c28af4ee48afe5f922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\b26863c92a647caeb38f5d83cd188cd2f36208a4\index.txt

Filesize
82B

MD5
77ffdf0707a80559a0e7fd8f9a7a620e

SHA1
53da001ba0b695e88dd9f3d31f5b0bf8a005bb75

SHA256
bd6dfa784bb31cdc473cea373cf67f9d22278922318d467e886f686408f38e9d

SHA512
35369402d0ee9d309106448a7e74f4352375ae75bf9807738dd3205c76a63400547fd32c76ff43a26da512de50554467e35c2ee264773be4378dc3e43a3ecbc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6a4d4bd8ad36d510f4efe4fbcdf134d2

SHA1
010cdc682b8c23e54badabe71b00d800f172c397

SHA256
cb2c72b24b62ddff833cbaf9f56b9580830865fe454d2b6e2509912e563bfb27

SHA512
ed8a52286f78413be5ba89795d43109fa13831e632c1d02b9a962cd74da61a0fb2e5164f9eeb96fed334b2573aa4914c1490a5088e7fb180d4d85e684fa9ccec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
18bc07d05ee49e798b7c2c96cc73db0e

SHA1
e9d45d30befa4e870ed1d83383b3d6cc908f2507

SHA256
fa868785e632bcd4de095779fe5b8a36b7070576031acfc97a7676541a82ba2b

SHA512
189c0ffcfdc235914b4fc8a646b353d81436300d6f4625165245179fe90d0ebd124337e1ada40f5623c50ebc45295b90007e5bfb887e35afdbbe5c39b3348426

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582536.TMP

Filesize
2KB

MD5
d9da21b61cd51224ec39825b30f2301d

SHA1
253cece1aa4945facef51be390048a93b98b6622

SHA256
b0eaffc832d5347026a7059fd2b849145d58b39cd474f6e9ace41982250c9c29

SHA512
c9a43de9e6920b61b4ddb10b70617c0a99ed90b514dfabfd6bf16d8ed0f3660d12c20bf6aeefce55f4b14c140f63355e7a53de21513222bf9d8ed3163713d757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a7315aad060bdbe9b63a083f3f6ed886

SHA1
fa573fa3c118184d8d012ca59ecef78389e4ab9e

SHA256
bd26d4d2521f06b9f920c1051c383aa5aff027a0c07b7cb4394b9255a1ba5693

SHA512
21921c1587d22ff53200836609d5e0fdcefdcc47d2b5b597eb152dd6187c8ddf1d2a93e3876fa5f6efb9835f7996865874376dfefdc975bc4626d1cc612a0bc3

Download Submit
memory/856-203-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/856-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download