a85cd0a43faf0de59729bbe5b3189087e08ec9138cf5acac4e2cda9f9e567b19

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe
Size

298KB
MD5

a89c79ea16938cede9b9b52a11d33fb8
SHA1

0d37a98824f6ccb470cc39c73c809e336fb5543a
SHA256

a85cd0a43faf0de59729bbe5b3189087e08ec9138cf5acac4e2cda9f9e567b19
SHA512

3d570ac5798de05ffb5acec91d807db6ba22bf7aa0c0e83798ee706808f5207a31c3ed1f36dd7c5b93fd7f013a1c9210e4a89454eeef104bd8d8dfe691cec380
SSDEEP

6144:BdILOUcqGyItWfpMKjjOOKy3fvpPMJ/TFF:BdIXTItepMKvOOKy3mJ/T

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4612	firefox.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
3320	msedge.exe
3320	msedge.exe
3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe
3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe
1500	identity_helper.exe
1500	identity_helper.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe
1928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1008	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	85
PID 3176 wrote to memory of 1008	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	85
PID 3176 wrote to memory of 1008	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	85
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4612	3176	a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe	86
PID 4612 wrote to memory of 3320	4612	firefox.exe	93
PID 4612 wrote to memory of 3320	4612	firefox.exe	93
PID 3320 wrote to memory of 1652	3320	msedge.exe	94
PID 3320 wrote to memory of 1652	3320	msedge.exe	94
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 1856	3320	msedge.exe	95
PID 3320 wrote to memory of 736	3320	msedge.exe	96
PID 3320 wrote to memory of 736	3320	msedge.exe	96
PID 3320 wrote to memory of 4468	3320	msedge.exe	97
PID 3320 wrote to memory of 4468	3320	msedge.exe	97
PID 3320 wrote to memory of 4468	3320	msedge.exe	97
PID 3320 wrote to memory of 4468	3320	msedge.exe	97
PID 3320 wrote to memory of 4468	3320	msedge.exe	97
PID 3320 wrote to memory of 4468	3320	msedge.exe	97
PID 3320 wrote to memory of 4468	3320	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a89c79ea16938cede9b9b52a11d33fb8_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\temp\firefox.exe
  C:\Windows\temp\firefox.exe
  2⤵
  PID:1008
- C:\Windows\temp\firefox.exe
  C:\Windows\temp\firefox.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=firefox.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf34746f8,0x7ffdf3474708,0x7ffdf3474718
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,7293988964773048569,16909680130693043148,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=firefox.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf34746f8,0x7ffdf3474708,0x7ffdf3474718
      4⤵
      PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
c2deba7a0a66df29e8795372d9705a1a

SHA1
839838455f17c1a127389e49a1f21fad1fde1188

SHA256
f054415bff036ca4b3c8de609c025e9f855268d4006ed92bb24bd877d39c1300

SHA512
b0f65f13bd78a03866a061c8d18d2ab0bbcf4213de6a0e6ea185dce19fcd18083925b9f542490ea37cb42e0639f6f0f59ddd296b946da0a1c19d0f0f89bfdec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc4f555e2bc337cca42b218b48d910ea

SHA1
7e05583c07e2770189f792d9f2502a6f0f18c9ee

SHA256
c39510fc4ae285e00bb45d55eb81b7e19cea3a198f8c8f0fe5732288a9e2880a

SHA512
e560d925d93b0160ec0874c6e4c2a28c1b448fe5a8565b45a8970bbd36b67c0c30cc21ddfd03cb5147305bd0eb4ea0f1d49163ccd74ace2cd2f164768b3fbd2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20b6ae4fcba0d76dc4f57c8326d7bdc8

SHA1
e7b81fb1b99c54fdbb03d4ac87f807502fe4ddb7

SHA256
463718164ceb914b1b9088c31ce02905a4a1efb87f2195320306c6f7978f8304

SHA512
1c6de38b6f6802e6532e12c373d75ae0fe46091030720c5931ea24669ca9ace7a5422eca1c274965552d5a700b710ed5924d94f56ebbd94ac9c795f5db822935

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9b6fbf996e884d7ac787e073deece48

SHA1
3f7dd2eb3b6c1bcbbb173037cc62d85609318b0c

SHA256
622430001a1f4917d52de88a8d3158a0586129c3f0a9057d99580cd5b9e31ec4

SHA512
11fa13cddb1387f748cc2bd4a81c0fb63e10f08607738adb0a30832318fba1e3bccc8fe890143c1cf14c7d080eafe70b5408226703d8a0c57749f7f1b0051f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
d77bb8aa9a87b53d45f8156a9d97e8d0

SHA1
8cab901c70a5ba2e5cf89636e20537c696a876dc

SHA256
d80a63d69b108a1b7493f10cb7c7d229835861b2424726caec27d48c7d45ded4

SHA512
856fcaf32c7642341f705fc5fa72b454e991a76000d6a8e0ea87ecb0a67eccc98ca63d325454682eee19d46db9e4cbb2bbf1f2c2121fef15f5e9c54d71463e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580aa9.TMP

Filesize
371B

MD5
f38fe133b01d98912854e2fbfe03889b

SHA1
6658b1b0246a5391c8c6987e9d11c081b673f21e

SHA256
04aadce89295be7b41c96973891ca1f5cad4f7a0757b079b413a1bdcfbe75325

SHA512
964b455388592237c3688708c6cfd38a293d6c6e0d8e3dc58cab42192806f01feec1c144fbe69486136670049e640d88a6ae744780206dff4f6c231106a1028d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64b83e2632dde702b6ba4173a0e59286

SHA1
c5daadb2450abcfc553b0de160432e20e56ff433

SHA256
ccc19ac6d0ca97c6a94c6e419b52cd2ab7f239cecb0aacdc71a9e926b8060e48

SHA512
a1148aa1cb379ede82bd882f2c1e9587de183c780d375b0d6f49c97a5a9b1aa84bf99697d7e2cc08ea46302648a53a7ceff317bc240aee3167ae530f58240f73

Download Submit
C:\Windows\Temp\firefox.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
48B

MD5
75144e9e4883f55e957581b3383d5676

SHA1
8f8c32b7bf64d41219506de62e164026ddee1faf

SHA256
b67c13a98d26f83281c8b9b9acc194e0095a504003cbf077bcf87fff3fa5f02c

SHA512
b1c9f803db943b63222cefd18b3d7e34fe14c24bbbc38882c3fc321d094dce28d87ec04d57cf99fa69c9fb7ed165728a38e494d451995c7795d4f74412d36f6e

Download Submit
memory/3176-61-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3176-0-0x00000000753C2000-0x00000000753C3000-memory.dmp

Filesize
4KB

Download
memory/3176-33-0x00000000753C2000-0x00000000753C3000-memory.dmp

Filesize
4KB

Download
memory/3176-34-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3176-2-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/3176-1-0x00000000753C0000-0x0000000075971000-memory.dmp

Filesize
5.7MB

Download
memory/4612-92-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/4612-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download