d1b957c4daf6f14ba566b6350955b8cfebbbb91e5075c5bffe0ece7517f79854

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
951c3b24dc44a0dad7c8b1294f11a5de_JaffaCakes118.html
Size 7KB
Sample240814-h2dqsatgrp
SHA256 d1b957c4daf6f14ba566b6350955b8cfebbbb91e5075c5bffe0ece7517f79854
MD5 951c3b24dc44a0dad7c8b1294f11a5de
SHA1 bdc054b6556a02b7e30c26e0bfcf93af4d8744b0
SHA512 d38277c870ff064ff7994a8f18dcc587bdd7f6c6eae49368e517bede03a0293318d38b8f1f0363adf7ee1e2237905168baacfd2891fc70b7b9f7f78c74f02ee3
SSDEEP 96:OdTVAFGuVrktwlcci2eBm98IM6Xfe6bpaI9G83TrRuZP0mrKBUZ:OdSFGmk6l5eI8Z6Xm6bpac66BUZ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{92C16978-86B9-4111-91F6-5829DD5D015F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3000	msedge.exe
3000	msedge.exe
1004	identity_helper.exe
1004	identity_helper.exe
3512	msedge.exe
2584	msedge.exe
2584	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4132	3000	msedge.exe	84
PID 3000 wrote to memory of 4132	3000	msedge.exe	84
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3756	3000	msedge.exe	85
PID 3000 wrote to memory of 3060	3000	msedge.exe	86
PID 3000 wrote to memory of 3060	3000	msedge.exe	86
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87
PID 3000 wrote to memory of 2592	3000	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\951c3b24dc44a0dad7c8b1294f11a5de_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc57f46f8,0x7ffbc57f4708,0x7ffbc57f4718
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,8694060023564938869,11197209056027163621,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 bece9500473d31d9994b198c25649605edad90c9c1d4febae26c3f2d25b4a38a
MD5 04d44d825c5fa79e2fbc1925aea7b2f8
SHA1 0f3937fcd8bb5cde4640e1cea9b0551caf737685
SHA512 0080d24838bd7ffc9d9c43aa5ccb999750ffe84c85a305a2911d35ed63d0e38743c46925719014487e3d2f21ef0039e1f824caf5f3e4263c825e42754453e1a4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5bdf7df98cdbc2c2b167f4abc9527646f6ea8f4235c7e7eb58818900e732c5c3
MD5 106ba9c6fd8f5d1f86d19e9184fe56ec
SHA1 628d3eb84e05f749176711d7dfab56714cfb19f8
SHA512 447d83293039adb6cc7775ae3ccfb368afdc4f870fe663cddbcf30de9aaa1f2899994284df9a312f8a3ba2313e74f4c8ecdb717eb5f969907616bbe29ca5eb23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 175da48930e6adb83c8f53156a5c20c5ee79fe9339f32d2f26bfd8e0a2166686
MD5 da423e8890aacf627ffcdde6bf047e01
SHA1 b9eae5b503e4d1b2e813e18226eb248643c06015
SHA512 90ffd8aba9b85ca0e1cffd3c1a5feebe23eae4cca6a2f1946a2ab0e253d00de0a21a1338f5f43182c0263af4683538d1a7ac9ba60b1de19a110055c653be5b99
SSDEEP 96:n1kzDxm/LQYmqw1WITtwpvWMoiVmdeHTbZAUWQyV+VDCziEwb:n1kzwA7AWGWMX/ero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6bf1bce03e84794819ce36d82cefe5b24f6b0dbb1b55878eff99b11d47b06595
MD5 e83808d0c418a48d082e47782acc4aa2
SHA1 7f19ba97c9dceb858d90021645fa559edd472e3e
SHA512 90c5d322d4b83d9edda56c3e77e614f854b06db7fd9093d564edc8937f112477cbd2cc6ebf74cbad99644705c50ea1bdbe2b29104271b85f30c16634ffb08618
SSDEEP 96:n1kzDxm/L9mqw1OITtwpPE9WMoiVmdexf02TbZAUWQyV+VD7AiEwb:n1kzwE70WsE9WMBM2/erg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f12ac0d7bbfe8b165c1e4bc46fe3be416cbc1a2d9c2acddeba34a560eb8fc8de
MD5 efb47edb49f4e3efb61f65f408f24c21
SHA1 77d51779b0ebfbc973db486ea21ca94a6955f208
SHA512 bcba252cec472e17d9e7ea72839bd7328c961b97ba6fdc829cf09e2b7907b0358c41653091b19d407edc737b6f72ce7f23df1ac95ca2c929c55316fceec29d0a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d1e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d1e6.TMP
Size 1KB
SHA256 6c42692f246e9f7bb919c83778c0443144c4a7643c0d84187449a44d97c84407
MD5 72b899a05f7faaf396ed8a1e22d4f970
SHA1 a93e7e009bbee69bce6a95f655964738e68640e3
SHA512 237982f7e7fe591ceed02e1b5f41d2ab0fdf30e54e433eca9d9601380f862828ee4a30ff09df382fd8915fb259056c2c875b3a4c029bac8d46f305030f3af5b6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f8304df06d0c33b2086798497bafb8163f2de2e50aea5b8268d3f8eaf4b82f23
MD5 86fd0c9c812efdf841bb8950bf39d211
SHA1 1aff42c623a074b19295bad7119569d3fc4386db
SHA512 f5af1d5280e8b2471efc284d445e6503220ba0959c72353b17d852dfb365fb24a834d35bd93b4d88499d00785fcc03a81b0b9243452751dcc1c2f6c0ae6dc382
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprWFe2RUIkjnru8z8ZJupz:A9iIxuERzA83h09RZxYr8gnPz8mpz
MD5 SHA1 SHA512 SSDEEP

Submit Download