667a1d43ce602f37a53e4427de5295f28d0acafff387809d7421c3f768943969

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe
Size

1.3MB
MD5

29b1dfe207bd701aca8b41f6d322f72c
SHA1

c9edde7535a72d09eb1a1b3dee4f8bf6bc14681e
SHA256

667a1d43ce602f37a53e4427de5295f28d0acafff387809d7421c3f768943969
SHA512

cf02864c4e065797b79323992e7be3aa44ec616171241d573e40066613fa2104c8b72ade7f7c71f4bb25b93d912bf460471335d1fc43ede01b346fdf32b97bdb
SSDEEP

24576:frJKUK/juqkncxnfS//2oYP+ENxuIW/Rjl/lVlP64htKQtsVELVDiicYQRebMyHz:f1Kb/juqgcxfSE+HIuRjl/lVlP64htKB

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1236	crpA691.exe
4828	hpet.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json	hpet.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crpA691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpet.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
4828	hpet.exe
2548	msedge.exe
2548	msedge.exe
4544	msedge.exe
4544	msedge.exe
2220	identity_helper.exe
2220	identity_helper.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	1236	crpA691.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
1236	crpA691.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
1236	crpA691.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe
1236	crpA691.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1236	crpA691.exe
1236	crpA691.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1236	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	86
PID 4068 wrote to memory of 1236	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	86
PID 4068 wrote to memory of 1236	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	86
PID 4068 wrote to memory of 4828	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	87
PID 4068 wrote to memory of 4828	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	87
PID 4068 wrote to memory of 4828	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	87
PID 4068 wrote to memory of 4544	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	89
PID 4068 wrote to memory of 4544	4068	29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe	89
PID 4544 wrote to memory of 2432	4544	msedge.exe	90
PID 4544 wrote to memory of 2432	4544	msedge.exe	90
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 1712	4544	msedge.exe	91
PID 4544 wrote to memory of 2548	4544	msedge.exe	92
PID 4544 wrote to memory of 2548	4544	msedge.exe	92
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93
PID 4544 wrote to memory of 2428	4544	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\29b1dfe207bd701aca8b41f6d322f72c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Users\Admin\AppData\Local\Temp\crpA691.exe
  /S /notray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1236
- C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe
  -home -home2 -hie -hff -hgc -spff -et -channel 162341
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/rar/VR-ysGH_/UltraISO__Crack.html?ref=downloadhelpererror
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ee546f8,0x7ffa3ee54708,0x7ffa3ee54718
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2634069213837324433,7041890883563100043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98cb9badc2344640e1569d090a25d01d

SHA1
7c0cfdabfb1ff30a21f03224642efc254513825c

SHA256
a9d62f54361dba3d48307d1c930e6898ab9d52f8b551c0f38f2f507731f73edc

SHA512
0060d27aa153f3df6ff55bec9133dcaa779193f4f441739b5222e05e2ae8f1de9d250c2045a52ec0d84bca626dcf157f3a6d5d58550c8a1d0e8b601f202d4829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3612a70bc448c0b1ab0861d430a6bbc

SHA1
a008b2e66a2dc3c3c5e8024c439e20a2998663a7

SHA256
2da5a273ba66f04b62e7c7a664b834b1843400029ddc77366ec159d1265571b1

SHA512
895fc95bad9a67ae1f82ae18ee9cc562af2721d1d449067d6913f9c78786412e380f7e0f6a97bac2299c9b95415f74d418d19e1479724d3020d63661e32c0de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c28be1920a85710ee9f95d7e7fe310e7

SHA1
10a280d57ec65c0f82b753bb88392e73dfade551

SHA256
7de46aac18d1df47e29021d4bce1dec81239d0d5f834b2bbf1e0aef15f83c74e

SHA512
c645fd2c1eaea5a1de6bb9a7453afd1a7ea8bbc3fa12a6cb8816a52ee060633f8386b9bb8e7111ec01a18799e473897dc58d7ed8cbec40c903f8ba76b3fa1a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\crpA691.exe

Filesize
806KB

MD5
661cf9c90eb099fb7b6a394dd8cde2e4

SHA1
3704e119ea16a3c336f63dc808176a22fbb8582a

SHA256
1570e0efe0cb98623913d942cf40f2eb5b10458f49842097125c6d6d8604cd07

SHA512
13c26a514c2022a10b42566a527ef98adaaa9932ffd07612ccdeb371888c037be3b429c956ecb7705699a2b6e3463758735332c9e26ea5f4493a91f30dfb4761

Download Submit
C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe

Filesize
331KB

MD5
a3e93460c26e27a69594dc44eb58e678

SHA1
a615a8a12aa4e01c2197f4f0d78605a75979a048

SHA256
3a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6

SHA512
39d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530

Download Submit