dcc32452740e2cd01eea479d792e75a1f441513869423f7e851fcd08e2c0548f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe
Size

1.3MB
MD5

16affbcbdfb60a64540c9cac9c609391
SHA1

1297b4e9992765255ad1fcf4d5a4c9c399d09ccf
SHA256

dcc32452740e2cd01eea479d792e75a1f441513869423f7e851fcd08e2c0548f
SHA512

99ff64de97c38ff4f48f16cef951c66578bcac9628c1350c02297b98bb589b2d6e6b5e93e2489ac4ca789c2143a9c7361e8d497862fe577af9512c682897b33c
SSDEEP

24576:frJKUK/juqkncxnfS//2oYP+ENxuIW/Rjl/lVlP64htKQtsVELVDiicYQRebMyHz:f1Kb/juqgcxfSE+HIuRjl/lVlP64htKB

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2220	crp9BB4.exe
468	hpet.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json	hpet.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crp9BB4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
468	hpet.exe
468	hpet.exe
468	hpet.exe
468	hpet.exe
468	hpet.exe
468	hpet.exe
468	hpet.exe
468	hpet.exe
468	hpet.exe
468	hpet.exe
1636	msedge.exe
1636	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4376	identity_helper.exe
4376	identity_helper.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	2220	crp9BB4.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
2220	crp9BB4.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
2220	crp9BB4.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe
2220	crp9BB4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	crp9BB4.exe
2220	crp9BB4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2220	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	82
PID 4060 wrote to memory of 2220	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	82
PID 4060 wrote to memory of 2220	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	82
PID 4060 wrote to memory of 468	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	83
PID 4060 wrote to memory of 468	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	83
PID 4060 wrote to memory of 468	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	83
PID 4060 wrote to memory of 4244	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	85
PID 4060 wrote to memory of 4244	4060	16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe	85
PID 4244 wrote to memory of 3184	4244	msedge.exe	86
PID 4244 wrote to memory of 3184	4244	msedge.exe	86
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 4508	4244	msedge.exe	87
PID 4244 wrote to memory of 1636	4244	msedge.exe	88
PID 4244 wrote to memory of 1636	4244	msedge.exe	88
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89
PID 4244 wrote to memory of 1592	4244	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\16affbcbdfb60a64540c9cac9c609391_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\crp9BB4.exe
  /S /notray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2220
- C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe
  -home -home2 -hie -hff -hgc -spff -et -channel 162341
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/video/NGkclQgh/_online.html?ref=downloadhelpererror
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba3ef46f8,0x7ffba3ef4708,0x7ffba3ef4718
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7779871213049133098,7748592015965306740,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
276a8a3553d16750366abe5b1bae4ede

SHA1
df34825195caecf1c3b955c6fbd43a0e90ef8d18

SHA256
8b6cc555a0de1ed7085bd3fee7f5fee2c6b1354477a9858e7c549145088a0725

SHA512
21ac25b40a60f0957732d1c7aa4a53d95b4dc0abef81f9cdfc7c3dc1bd38a04650e21bbe1c786a5596b7b2079b8782414a0027782f8c859d4153e1be50b1f77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d77f2a7439147753986e895fbbaef724

SHA1
cd9a8a4db5fc8ebdfa6c8b3cbc4284a61a73539b

SHA256
62125b17a8a176303c731fa18b864fa07a1887c1c83200e6eaa79b2e1141ccfd

SHA512
87041497aadb6830bb156ebe5ade86205b829cde7bd37245ea2f26ae4fd3a1a7bdb680ee14b87966e82bc3b894ce97e3a1d4f3bb219589497864856ac00b935d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
248fee3a792751ac773a61408d6c464b

SHA1
57fcaf502a7dc3148ffc154500bef4b6dfaab767

SHA256
4e4f2b806131d9a5bbe84c4c69d43df4211c778a738a9e9093683fdff7d567f5

SHA512
b76fccefc57467ca16d8760a041ad94521e524c8f85de95ecf6f6921f0e2a271061f92f33c9b9e2a697f580cbc68c45a91e2eeafd4c9164f68fd569ed9e7c310

Download Submit
C:\Users\Admin\AppData\Local\Temp\crp9BB4.exe

Filesize
806KB

MD5
661cf9c90eb099fb7b6a394dd8cde2e4

SHA1
3704e119ea16a3c336f63dc808176a22fbb8582a

SHA256
1570e0efe0cb98623913d942cf40f2eb5b10458f49842097125c6d6d8604cd07

SHA512
13c26a514c2022a10b42566a527ef98adaaa9932ffd07612ccdeb371888c037be3b429c956ecb7705699a2b6e3463758735332c9e26ea5f4493a91f30dfb4761

Download Submit
C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe

Filesize
331KB

MD5
a3e93460c26e27a69594dc44eb58e678

SHA1
a615a8a12aa4e01c2197f4f0d78605a75979a048

SHA256
3a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6

SHA512
39d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530

Download Submit