4317572f5f13b0edcb1e5ae9a510af21f9ae1635983e1b3095192de971560f87

Analysis

max time kernel
147s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Size

274KB
MD5

27890f1af0aadfbae6e1baacda23703c
SHA1

c05b9fbf4573132bbfb75da831981439a444910d
SHA256

4317572f5f13b0edcb1e5ae9a510af21f9ae1635983e1b3095192de971560f87
SHA512

85f4ba8d8f821ca77e335a94e8c07728e3fce747f991451fc981098abfc37edae02870f25169da6ac8fa8aecbc9f31c7822cae709719e7145f2a5e6943610da4
SSDEEP

6144:GckNY+ogm5Iibc/POOOOtOOOOOOOOOOOOOOOOOOOO+OOOOOOOOOOOOOOOOOOOOmN:Go54nOOOOtOOOOOOOOOOOOOOOOOOOO+s

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rivalgaming_cookies_remove = "cmd.exe /c del \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\rivalgaming\" /F /Q /S"	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rg_unonce = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Uninstaller.exe -quiet"	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
1360	msedge.exe
1360	msedge.exe
2204	identity_helper.exe
2204	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Token: SeDebugPrivilege	1488	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Token: SeDebugPrivilege	1488	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Token: SeDebugPrivilege	1488	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
Token: SeDebugPrivilege	1488	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1360	1488	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe	86
PID 1488 wrote to memory of 1360	1488	27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe	86
PID 1360 wrote to memory of 2156	1360	msedge.exe	87
PID 1360 wrote to memory of 2156	1360	msedge.exe	87
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 224	1360	msedge.exe	88
PID 1360 wrote to memory of 5104	1360	msedge.exe	89
PID 1360 wrote to memory of 5104	1360	msedge.exe	89
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90
PID 1360 wrote to memory of 2172	1360	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27890f1af0aadfbae6e1baacda23703c_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pages.rivalgaming.com/aj/deactivate.php?p=t7qy%2F83Mwsu2tbG1srewsvro7enA6LLM%2F8awt7XFtcbBu7aysLK2wcf%2Fo%2F%2Bz
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fc146f8,0x7ffa1fc14708,0x7ffa1fc14718
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10610844135573171897,8745654524658123038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a690ab206a3f6f1e38c02b2214c78c7

SHA1
a52a273cca7bb457dcf2f3acdbc8cfa950b6e1c7

SHA256
7a96dab905cd76bda73ac88baffeb805ec4219bff2645cbed93b9cf19f6cbd1b

SHA512
c45534ce90631dd189b1ff3e515649135b65983ab77a8b96979bda31f93c942a7c60a0769324b34d40e0c0686964a11b67b316a6a93ca37d7b03726e4a9c27d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee60390711820a344d1aef8154db7327

SHA1
e9f03e026731470616edee3011e46de7abd78698

SHA256
9fb1fa271634cc96bd9f5ceba5b90b5cd81f491d83c43e72b9129bd97b47b821

SHA512
2863e517fd713a4e01a04d3a1d288375b92c2054374a53f1ca001dc59e267a99c95f5a074656a6f50561309f74b12713f22f4803276c0640abaa25b7fcc75b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e929f6fdc1c37c09cfb591cc69b483d

SHA1
cd82209295494eb91c8aadce4d0110ed16c79fea

SHA256
128ab46f389ace6bc9c2153d398fa6a716d30ccc769fae85e896696daa143c32

SHA512
d35817d957c4b7600526b4307489c92b87e99c7ae4a49c58d2f80ea2bc24fec85cff80fc22f82b99de32cf596e50f9ddf2aadc51727daaf731bbd823f1fd3195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4184f8df7e955aae62845e623b24c07f

SHA1
e4166261a1b5c5b809b82b756ced8e0a7202dde6

SHA256
2455baf0ffb57728e4e4850d6346ebd716c127ac53752fe64c7b83ce8ae71439

SHA512
97ba80490806ad152e40b70b0cf0d57982ec7871becdfd1f8ac6ebcd37309c4554c0f3a3629a83dfe6d1dacaa102a36ccf92ab759154448daf5f21cc2ad318bb

Download Submit