589ccb38b92ab686e3100b947036bf6ad87f833ae0eb3b8c988fd496fa7d7dd9

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbafd1085e98ef09d2e52ee60edfc948_JaffaCakes118.html
Size

138KB
MD5

dbafd1085e98ef09d2e52ee60edfc948
SHA1

99f999ca46468ed7181fe38501bfdd0e456efc3f
SHA256

589ccb38b92ab686e3100b947036bf6ad87f833ae0eb3b8c988fd496fa7d7dd9
SHA512

fb6b94d50c088c2b10304cbe45443797cbfba1c3db0ea4d34027700f546f982bf8c315935c58fa4563ba6f33b86e6aa9ac2ec68260eb6afa9272b588c34b61a5
SSDEEP

3072:tb+HWtEdq8MTK7hOflJ1WzdaWE8rR17WNtQrYuZSD8qj2+39pZcvMnGZoIgzW0jU:8HWfJW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{37F23D9F-D855-4D98-B4E2-48E79955C93C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
3748	msedge.exe
3748	msedge.exe
1936	msedge.exe
1936	msedge.exe
5720	identity_helper.exe
5720	identity_helper.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 4392	3748	msedge.exe	83
PID 3748 wrote to memory of 4392	3748	msedge.exe	83
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 1976	3748	msedge.exe	84
PID 3748 wrote to memory of 4036	3748	msedge.exe	85
PID 3748 wrote to memory of 4036	3748	msedge.exe	85
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86
PID 3748 wrote to memory of 1088	3748	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbafd1085e98ef09d2e52ee60edfc948_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc457746f8,0x7ffc45774708,0x7ffc45774718
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8384 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17272529096394086278,18187558201411684459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b9595aa-5667-4d90-87b2-7cbf082e2f80.tmp

Filesize
10KB

MD5
6085ea25b63bb4d8328a97e93219992b

SHA1
57b2a283bbf6698cc7be90b94676aae9e8c2209d

SHA256
a6a669e59f0623cbe4b64aa55f26b26b27dc3d00cfc9982127eb5499f5cb1e84

SHA512
92fdf48de48840698ac29850c54494e4653e9365edee3321f522f27689b57bba7aa6e28c5af137a4f284a7708957ca630578b8f454246faef0a3ee12bcd1405b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
24KB

MD5
d1c8fc93e329cfdb4cef6b1363e40db2

SHA1
2d034d8d0056a8c1596714c7129fc31c74a2565c

SHA256
facc5d448f6e3267100a4c236f09aa98bea1cc3b19e2b2a0985501ca499c4ca2

SHA512
07434e4af30064d5f67158d10b704afccaa31f974ccaca5e76dc9f1b05d76106b44f124c3a94af93eb1b44a5aeaa70ebc33e0f9f904d1cd4c8386b281735d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
45KB

MD5
aa6a698d1c7fc6d35265b10af5570e9c

SHA1
00da372ad4964a5d5b8afff7fe1b207ff284f232

SHA256
02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

SHA512
f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d6ceebc238cf380f014eefab7c2509f4

SHA1
876f5bf87ad28435cee8573a1ec1dbacd3e81427

SHA256
ccdd6dfe5384f34c6c2f94db1270adf1e26854b7b678b63068b399e4e69372f7

SHA512
5b976ef195aac42e760c0b367bdb4441414195f87bcf8b6bfd046bdb083db2d0f2ec77342586730093b0068ca0047c865cac320c2d111567bb3795797ce8d556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
817186be72e86f293f4fb2390d71f069

SHA1
386bf64a6672c7b4bde9794d268f571eae3d800b

SHA256
040b2b4f9cbcd500373f2177c51f73f21ff36fab8e0e14e0fcae66d8d53bfd51

SHA512
e6e7d6ec51b9643f5ce7ad3b30b965fb4a6540ba802854dc03190df9c36d4de8997a78ee032d80074a3b1901ad4b4f346ce02dcb274ea013dca15b7d5d528346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
9a57a824a03a0c53a41c2dc76a4bf07f

SHA1
9c715736b7305108cedafc05e33a513a0241d47b

SHA256
22e4a1a357743e11f8c71b10908fbe3c82e1e5e162d47b483c8bb073d3650e7b

SHA512
a028b2b68dd3ef5e4868950face92721a181da158c35f7811208271c4e9a33df336b9e1372c8bf01ae1eb3b6d225de8a877d83942a96cac6745edc9fa65ab8b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3b6f2f241dec9d9e2b2dc34dc6f7f9bc

SHA1
74d3dcd22c7893eebb437aa03f1e8f5f4043060e

SHA256
f811183fbe4f4700146c1f1f51a6164554ff967477be7dd5a0946d61c52600ea

SHA512
63f527cc137e4b3d0c2cb4d3b21634546a8bc372413f48730270aaeb8e41756177bf64b7b1c3e82c25b0b11da6b75d0a7f3a7e654319493f09102e805cfe5008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
514773624016d3ac0f1d235ba4d32499

SHA1
bbc09ad5b3c0fae5b34b0dff46a94b19c94af054

SHA256
59375e96d117268c00afd5010d325cb9d8fbf8b6f37e6a6327ab0fa13c5c2784

SHA512
06113667992d1ab9968e97a21f87a6f4683db888e0ae1626d3281eace8f194f06ff90fa8b93b22dcbf6295550908910d3b40c8fb0bd447f73ff029d6b960a743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
33e0cc9870719d3405062cbc6424a202

SHA1
9019e789009037086ffa596af9ffec4ae30890d7

SHA256
a0dd06afcc0e67e16e55c7153a1d297d9f46f43e4ff92af980487039ab09f626

SHA512
8eb3222a721132d3cf25ba5a36d3b6cfdb95089e90ab46be57c27786196f5d63f8f71f3bd942069e2f5fe276b2192a2d21f9ce0363a62e78c9bc231c41c47f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
89928f56baa68fcfebb360ee61545060

SHA1
14dbba7ab82bd63e6581150bd35c2a3817980ab0

SHA256
6ed822a305ffb25390c308064096544e44786fb5e0a4d7a8dc4ab188d5710ab0

SHA512
9072b690816be26866fb9a30a27bdecbd5dbad8a2676add33cc358a8af6166de69ff17db6480997293135b3a25a7490aa7587185554f5188029ba760a9f9162c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57dd9e.TMP

Filesize
48B

MD5
5b4297f84699c93a5b7da3171730525e

SHA1
22014973824fc774ce421dee6540664655d6db56

SHA256
f57289c7ce27b9746af536ad61042164298004962f4d9de10d90404e602cd121

SHA512
f304ed80b14fdbc0614b5757262dd7bfe8992c79adbc83c3a06e5e9ecc576b9ad2db6b6209811bf2e6670e5b9cb5d4b31324b6594ef215ddd6234bdf1b199817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5680f420c844e29433a59696b5315ad6

SHA1
a13b933085446883434e84bc3326b45fcea305f3

SHA256
376b32ddbcf592e9ca98066feec4c9f578f2ae92cfd95f107761adfdf37dd0ca

SHA512
a8a346909079279251b58cf28fae131a666524a9df84a209daef3050d53165eeb062993a01333d12698d38d34fd347356169f463c983444bed98bfe6c031661e

Download Submit