cf34176e512d994fe4b8ff5b45f8425dc480b20c876f00ee398d9b24f5061dd0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe
Size

224KB
MD5

95a5b0563f70c61af4b019e3b25cc330
SHA1

f2784dd20923061ae3603646e19b477bf1d867a0
SHA256

cf34176e512d994fe4b8ff5b45f8425dc480b20c876f00ee398d9b24f5061dd0
SHA512

8f41e5ea44dc5a6113514e7b115a685222f35f5a9a063eb53637eeb9c29847a50ace80ae2d9e5055508f54bd32b0ad8412127e601099c0fc2f5748d6bc1843e1
SSDEEP

6144:MpI3IZIlITl+Cr8qjJQdjjezuwjjjjjjjjjjjjjjjjjjsaLmjjjjjjjjjjjjjjjc:Mrl+Nh

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
52	sites.google.com
58	sites.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
256	api.ipify.org
258	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718105630-359604950-2820636825-1000\{6642E169-7ABA-46E9-97F1-9C30BD436169}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
2880	msedge.exe
2880	msedge.exe
1240	msedge.exe
1240	msedge.exe
5376	msedge.exe
5376	msedge.exe
6048	identity_helper.exe
6048	identity_helper.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe
5740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4160	95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4860	4160	95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe	92
PID 4160 wrote to memory of 4860	4160	95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe	92
PID 4860 wrote to memory of 3920	4860	msedge.exe	93
PID 4860 wrote to memory of 3920	4860	msedge.exe	93
PID 4160 wrote to memory of 1240	4160	95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe	94
PID 4160 wrote to memory of 1240	4160	95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe	94
PID 1240 wrote to memory of 980	1240	msedge.exe	95
PID 1240 wrote to memory of 980	1240	msedge.exe	95
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 3336	1240	msedge.exe	96
PID 1240 wrote to memory of 4744	1240	msedge.exe	97
PID 1240 wrote to memory of 4744	1240	msedge.exe	97
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98
PID 4860 wrote to memory of 2088	4860	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\95a5b0563f70c61af4b019e3b25cc330_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wawanfcd.blogspot.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x78,0x108,0x7fffad2646f8,0x7fffad264708,0x7fffad264718
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16216605630578874546,7832771376411120977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16216605630578874546,7832771376411120977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://adf.ly/27I8q
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffad2646f8,0x7fffad264708,0x7fffad264718
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3504 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7756 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7756 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5110798011529879740,18191502254752997883,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
21KB

MD5
c3a1bf5fbff5530f55ad9f9fa464f25c

SHA1
449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa

SHA256
4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0

SHA512
75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6c6745a455e26a3fc406e065eb8b0172

SHA1
46dbb6d03f45a6df338eb11d13564412cdc807fe

SHA256
3bebc4166e58b93389607f837d0cf77d294684b9c9f88b9e654af63ad8f67753

SHA512
a442296d64d2ff56ba047b933776c27b28ed9746486b9eb4861000f98dd7a9136a95396cc6a98dc60947a48147ac2abd450438d02ac307ed8e1847acb52a86fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
4b9a8cd0041dc69f2bfaeb45d18087fc

SHA1
0feefb232a0eedc416304f92ce0f4cd2266f2e45

SHA256
5e9d81cb66cd7fefa92cac463acab0abf4d446db335f5d6d07601e96ccd2596d

SHA512
1618d2dafdbbda26ab9371539801229a8cdef0dd749b56d743d9f8ef78ba89e5df54d76559e2f586239d5d66891783d3010ed4552e2b38f9b51c533b91e955cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50ed8fb6cdd148d427e394e36d986138

SHA1
f200687d287d158856137ce9fcfdeee58f6bba35

SHA256
ae2ed295fe9a21f15fe2e01c884718bf282a99c777197b9fffb1e300210762cc

SHA512
77bb981cddc3d3ccca272281eb694911a37dbaf08387f50ccec4a83d6d8f6be9175f9f2a14f39f779b3e2bac9380bb10360e30f708eada10c723ed67662635a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
f0db14fee2572e6b20d5285b989eb146

SHA1
27cf6449c6e56fcb62bcf52cbfca2a50ee61d48f

SHA256
fd438a258947d1e756a01256f314413ca87aedee913c4b30f79d4c3b64d6a5af

SHA512
996ff1ca13d2cb8fd3631e920d2c3688cb1768aa8805f003bc99b863d069cc23693bd28d2d2b96724c2897c45797974c3c6dce3a371b39b4ebd0bc63ca64d4b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
3b15cceb43322352ab75438df4acd7fe

SHA1
a525a236b65757b8eb57a385229165861c920ed1

SHA256
5485a7023e2231227073a75265784853026aeb1e95b326cbbf1aa28fb72a3475

SHA512
105e0dc2fd9f3822feb1e5bed236fe30472802441bce4181a571ed5344a3bba89fe60178e2e6fb25405b8d47285d957a20891a44e439eb000a7092a19f797214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d54ca5efd787655892297c224016a7ca

SHA1
52d33fd687edcd181a17d7467a817bca5b197283

SHA256
8eaa688a194c645d9167a589ddc82c22151abcf2462fcf9e29791842e2e16885

SHA512
40035ae84c141376e7578ea64c8c48f1c33f86da8e2e08e4c8e53599a60dc7c4f08d83d1fae0bf4b43dc82e0430e5744b92ca3f93cabda2812b45e31b40048c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d6ac7b07db76dbcd4039d92566f47dcd

SHA1
8b44cb5e69e839de7f8a5b2c2d16023185dc6845

SHA256
6b37270497181b6a11efbff97074e0a2dbdd4a3891c5b97a0c30468df80ba05f

SHA512
8804249cd7307b41de7d2b008dc7c53b7aef952616f6989ecb8bf964e2962a928ced8e21b7159c371866a6b747c703dd3bf28c9ad87298fac63907193ef2abb8

Download Submit