b11f5ffdeee77d18b25bd2594dd3b80014c4715e0497877a0c5faa6032c3fab5

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe
Size

1.3MB
MD5

38eb1c21485ac830ac935e21437e5676
SHA1

65b3ace393ca5dae503857a3308b16f23053b986
SHA256

b11f5ffdeee77d18b25bd2594dd3b80014c4715e0497877a0c5faa6032c3fab5
SHA512

9af26770ba2a29e92002c5e44232863f83e64487ce1c2a242e9758ec377d4ead0a57c0c8020e88d691a7c9d425d6be094cffd4e890e36fed948d6926e9791c4b
SSDEEP

24576:hrJKUKRvzuei/bc6EGn5u5TtyJ8adjCzjyhhcDkPQcKiwMH5yUKc5thLfrXa7sju:h1Kbxzur/bc6/nRJ/aOheDkPQcKiwMHk

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4032	crpF4F0.exe
3960	hpet.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json	hpet.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crpF4F0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpet.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	hpet.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3960	hpet.exe
3332	msedge.exe
3332	msedge.exe
4812	msedge.exe
4812	msedge.exe
2988	identity_helper.exe
2988	identity_helper.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	4032	crpF4F0.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4032	crpF4F0.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4032	crpF4F0.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe
4032	crpF4F0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4032	crpF4F0.exe
4032	crpF4F0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4032	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	86
PID 4704 wrote to memory of 4032	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	86
PID 4704 wrote to memory of 4032	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	86
PID 4704 wrote to memory of 3960	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	87
PID 4704 wrote to memory of 3960	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	87
PID 4704 wrote to memory of 3960	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	87
PID 4704 wrote to memory of 4812	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	89
PID 4704 wrote to memory of 4812	4704	38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe	89
PID 4812 wrote to memory of 4728	4812	msedge.exe	90
PID 4812 wrote to memory of 4728	4812	msedge.exe	90
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3144	4812	msedge.exe	91
PID 4812 wrote to memory of 3332	4812	msedge.exe	92
PID 4812 wrote to memory of 3332	4812	msedge.exe	92
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93
PID 4812 wrote to memory of 1640	4812	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\38eb1c21485ac830ac935e21437e5676_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\crpF4F0.exe
  /S /notray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4032
- C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe
  -home -home2 -hie -hff -hgc -spff -et -channel 162341
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/mp3/ipV_Gt_1/Elaine_de_Jesus_-__Demais__pla.html?ref=downloadhelpererror
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6dfa46f8,0x7ffa6dfa4708,0x7ffa6dfa4718
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6866680938428748773,8747907724802734738,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3848 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9721f32c2db86a9611c9b1af41f0e05c

SHA1
3643d98141d157c602ac635d5aed656c4bc6ff0d

SHA256
ba54351078ac93514302dfbc116e3c9a5c3cb7d3d6786ff09767e2b296359f90

SHA512
acfac605651d1002e29ddf22f995e10bfcda26effbc7a3f12025114a7a19adcbdc82da9cf3a6708f1d62df59ce34f4977db9a159574e38d63b8ade5d820028e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ae809576d3d76010718b1298f4629c3

SHA1
78caec5cb11502236c120aadb3edf9fbc094b7d0

SHA256
bce68af6c1f69efe5a540af8e553a50845157d374ae6ca92a487c1a978d5f48d

SHA512
62665a3c5f5609133cb8032b0a93704c7fc3f7abd11a39a41fef1f599315270cd74eff5fd88749b8db0de29e4bf774e0fb76213e1119010ee3e8e0fc077b74c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
66370b0667ff924459cab8cd16b87819

SHA1
f7a8ff95c26a49fa2c038f6f9cfec82e19603add

SHA256
fb03662bd55558b0965cb6062c0bf54feeb339e92ddb8e5883b6458fd788ccbc

SHA512
b9224d56e3e35c3150a1337383488b62c60426b9004f5582f9427edec9b898c2e3e08539d2b3087d5ade4232125c5f137118de4bbb4b833fb0198d9310376c28

Download Submit
C:\Users\Admin\AppData\Local\Temp\crpF4F0.exe

Filesize
806KB

MD5
14ec55240339c1239a400fbb9bc060a6

SHA1
428982e064e12a4ebc3dbaab1f205aa17ab6b7c3

SHA256
9755e30cf56ab363aa55a4b6a74896ab41011c448aaa6c8d658de97c231ff084

SHA512
56074ff17160fb81aa6e6f0e408c4e91f4e9a8607b0d8a21248cc3b0b632a461f4e2ea4deaa1918cb29c114bb4008f10ce49e32c776a956771b77521bbbbc29c

Download Submit
C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe

Filesize
331KB

MD5
a3e93460c26e27a69594dc44eb58e678

SHA1
a615a8a12aa4e01c2197f4f0d78605a75979a048

SHA256
3a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6

SHA512
39d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530

Download Submit