hxxps://cdn[.]discordapp[.]com/attachments/1278788721273082049/1278788759931977778/RAT_Builder[.]jar?ex=66d56017&is=66d40e97&hm=3b2994e0eb3875bbc3de2605ba0ccf0f7026b18970e2800e3baa88c29d77f8a3&hxxps://dischord[.]com/api/webhooks/1278707372017057842/Xpss5RTpUweBMWZnAS5nsbEWz77hlT2OCYmDMd3mWLBLXIdbleySDumReMhMmISP55Lk

Resubmissions

01/09/2024, 13:01

240901-p9j14a1dqq 7

01/09/2024, 12:57

240901-p7ects1dmm 7

Analysis

max time kernel
136s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1278788721273082049/1278788759931977778/RAT_Builder.jar?ex=66d56017&is=66d40e97&hm=3b2994e0eb3875bbc3de2605ba0ccf0f7026b18970e2800e3baa88c29d77f8a3&https://dischord.com/api/webhooks/1278707372017057842/Xpss5RTpUweBMWZnAS5nsbEWz77hlT2OCYmDMd3mWLBLXIdbleySDumReMhMmISP55Lk

Score

7^/10

discovery persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlite-jdbc-9.31.3.jar	javaw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1725195600791.tmp"	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
684	msedge.exe
684	msedge.exe
676	identity_helper.exe
676	identity_helper.exe
1556	msedge.exe
1556	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3768	javaw.exe
3768	javaw.exe
5848	java.exe
4004	java.exe
3768	javaw.exe
3768	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 4908	684	msedge.exe	85
PID 684 wrote to memory of 4908	684	msedge.exe	85
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 5244	684	msedge.exe	86
PID 684 wrote to memory of 3588	684	msedge.exe	87
PID 684 wrote to memory of 3588	684	msedge.exe	87
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88
PID 684 wrote to memory of 4380	684	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1278788721273082049/1278788759931977778/RAT_Builder.jar?ex=66d56017&is=66d40e97&hm=3b2994e0eb3875bbc3de2605ba0ccf0f7026b18970e2800e3baa88c29d77f8a3&https://dischord.com/api/webhooks/1278707372017057842/Xpss5RTpUweBMWZnAS5nsbEWz77hlT2OCYmDMd3mWLBLXIdbleySDumReMhMmISP55Lk
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa10646f8,0x7ffaa1064708,0x7ffaa1064718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,2135374896510393199,11199676296342432972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5836

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\RAT_Builder (1).jar"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
PID:3768
- C:\Program Files\Java\jre-1.8\bin\java.exe
  java -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlite-jdbc-9.31.3.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5848
- C:\Program Files\Java\jre-1.8\bin\java.exe
  java -jar "C:\Users\Admin\AppData\Roaming\sqlite-jdbc-9.33.3.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1725195600791.tmp" /f"
    3⤵
    PID:1980
  - - C:\Windows\system32\reg.exe
      REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1725195600791.tmp" /f
      4⤵
      Adds Run key to start application
      PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
22KB

MD5
10f492521e5e782ab5509be8d97f7c20

SHA1
81529904d56f8b9cc04726fcda713df4e3dea964

SHA256
ec4e915484b22a46b5581ef39695832191c557bf4d9bd8238da468ad9e8a75ae

SHA512
c4b948c8aac5416d8203897f33c68790bbb56135b0d9cb0fc7bc0f3be6282062c94ff4b24c3345e0892be4e744203fbb654b276ebed947e020c322c2545cff3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab46a6c0c87cc28b03e1da04b6d7a579

SHA1
e6cb2b4e584310a8d0ef3aeb5274a7bbe4e0a88c

SHA256
bb3e1f3662412f79f18e637cc249eb62f835c0e3a8795485ca75e40f95d8759c

SHA512
d60ac03d57adb2914aeca0289d46fe8e809dfcd8bec5047b7378962c4d99c09f10588b0aa7e6dd1af376b1b86c27584e4c270677291ff41de7b16528bd190555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88b75e42b4437a43a16a44a291844157

SHA1
945780cc5a940915d8838a5be889131693310b3f

SHA256
0ce3329ea87751cc40d0512b874863da87a6186b16e32a3a21264be091a4abbd

SHA512
e5afd4dd0f29b34324bb6e30564d6ea249e8caf952e82cfd9abe73e9f9583f44c922e66123bcae7541d96a08ed98ff03f7b39d9a0ce76b26abdbd3d7277dd901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d39c24bd9ba567a8c8a2ab67865f2e2b

SHA1
e2d3b213fed56bfc1b8f683764c9ccc97fff8a48

SHA256
10bca81d4a606d8d419cace904c2db5f3fe02a6f3bc9fa0a6b29e68c50242ac8

SHA512
e31010f7114f5cfcb8d1eded64bc1f291f427c8b41f2b7d16b2fc2097781799df83b9c4785f9b5f97e03b10de55e3d92e7f6fadb740e967b7ec090569a70ee5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e72a0055cb48097fe3ed60efaeb6d34

SHA1
b0380b90539afeb58a77906beb715edb3b25e039

SHA256
cfaa3100ae2dee8639e00b0d4710d66c2311f7400b7ebf728d000e9ca4bb4688

SHA512
d8445cbb1bacb69a5f52a09a62c74d139fb67967ec6210d55906db0b37b4bbffa0ad85ad3faf5bcc8ba8f35cd6927d1d456c6ab2b292ddc1194a1f7fad0ef975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e086628c9dcf59a9b05b67a397b601c3

SHA1
193aa852c313669d5922d6750e8dfbd4157634e6

SHA256
d0be9c2d6362059ddc5e7c60e436342a37381e2f3d32329fc87c786d8556b30f

SHA512
359170ab4e6c66694962bdb4b1c8a3a1d5be79ae05576327e5148347bb0b614a53ea2ade44669cf32ac02528f663987d29499a197e605165d48d08a3bc02cc6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bd50721cbcfa15a8d0a9caaa7bf69556

SHA1
8e48f36ad04fe81d8bba1838d5d7239a242b010a

SHA256
03023bd7d8112226e2e36c5399a3d5a9922bc9bbbca203f9dc3dd3194dd0db44

SHA512
92a4fcecc943fb9a2ce37a738d2a7078a50f75a57ebe59c5dda4a71b3d03b253952cc67a0d43e4a23d7c9f779f1d3f7f86bb4dd843f7e2718595eed851eac9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3911eb426341c791ef27cf657d5c3768

SHA1
98d9cb108abec645286830eaafa44e1fcb3a5b3e

SHA256
199607ad719551c1a7638827f686109c5a2b1d46fe49d715268f27366875df08

SHA512
32e2967eb11ae84afc7eb83c8bc1331aefe49d04b84ac1581b0629fccf1c9e76ae355f511c336624186f672cc553e7d2d5ecede2ea501450b0e9ec544d6c7efb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4182098368-2521458979-3782681353-1000\83aa4cc77f591dfc2374580bbd95f6ba_ea0aa4d6-aa48-4733-9e64-85ab59ce35b0

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sqlite-jdbc-9.31.3.jar

Filesize
710KB

MD5
1164f82049eb573eec5cefeb31c4e754

SHA1
cb3f4b163d9ba9ec8156ff614241cc900fc45680

SHA256
e64ecfe647c70497d98ed615d21b9a0e293d5b6673bc955898f20437458aaa29

SHA512
bf332401e9c35f7b4b920d0036e298736829f82c9e4df2188359c24bb6f461587e51c5f32d82d54797990e27fea794cd885c7f27d393112c1ae7a85cd93f68a9

Download Submit
C:\Users\Admin\AppData\Roaming\sqlite-jdbc-9.33.3.jar

Filesize
710KB

MD5
9a802c2d3c892a65253bb2f224d25760

SHA1
89531e34e49feb85a0a3c0d06e31aaea671decf4

SHA256
4f6b6236bf318224a66e79e5fe1f018b1ccf3e7a7afb0dc910d02c8036594a20

SHA512
83fc31354fb98e829c6c980b3f066193e4e4d025bb19827d5a547b9e261321aa4811eca686f637833928597ab3455f9d07815fbf1852d9580ee42572a044b992

Download Submit
memory/3768-169-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-247-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-185-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-189-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-207-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-218-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-214-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-234-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-236-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-179-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-249-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-252-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-253-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-167-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-165-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-163-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download
memory/3768-129-0x00000236F73C0000-0x00000236F73C1000-memory.dmp

Filesize
4KB

Download