cb88631ca201185c03355a54394aae5df1f4b0fd60e0a9ca88f30f555ecf7507

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ac53f23cf9d1d7f408e390f5be74485_JaffaCakes118.html
Size 109KB
Sample241012-sxcb9ssaql
SHA256 cb88631ca201185c03355a54394aae5df1f4b0fd60e0a9ca88f30f555ecf7507
MD5 3ac53f23cf9d1d7f408e390f5be74485
SHA1 8df5d8385dfe0b870070890e31398648892ac5d0
SHA512 051b1db875618ec2e414c1776295153e8c07e9e4ed6c36001c13a8648f9d43374580130348066677b1b8480102a2bdf44e1467c78fae6d477c6c399d9cbfe1de
SSDEEP 3072:eIY8Njz2S81Ep2avb09DpsMlkeZAalXJ2R/I6t5EjA2Fw1Iq:w8R4BEYy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
2596	msedge.exe
2596	msedge.exe
3768	identity_helper.exe
3768	identity_helper.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1144	2596	msedge.exe	83
PID 2596 wrote to memory of 1144	2596	msedge.exe	83
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4260	2596	msedge.exe	85
PID 2596 wrote to memory of 4556	2596	msedge.exe	86
PID 2596 wrote to memory of 4556	2596	msedge.exe	86
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87
PID 2596 wrote to memory of 3640	2596	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ac53f23cf9d1d7f408e390f5be74485_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9994646f8,0x7ff999464708,0x7ff999464718
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16104396722594267081,12958644077516475329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4e4
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 23KB
SHA256 65edc4727e2bdb04a0ad28564af17bcf3bd7029811429804d283c8f0e186ce09
MD5 c6ee151c95d5bd2339c67eca774449fe
SHA1 c2de7e4a87b91ddd246fee53b8274b35fc55603a
SHA512 eb04604f00aba42cffeecf266cc7dbfc096708ebe615ed2141bd422585db26a12b54f9c22041c798cb01e4c3d3e5c70fff935b0c7a508fbf61f6201c3dc678b8
SSDEEP 384:VUOgw6ZANCOehcIFLQp2ZYy6V0Ygln90MqOFCTvhAhFn4/i5FJjW7aGsuDCtx3h2:VUm6qNBeaIRQor7lnyFqCzf/iiH2xxi5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 45KB
SHA256 c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051
MD5 ede70f717200a59b4cb831635de913a1
SHA1 d4d6e893ac192b5df087e924ab3356852f8a7bc0
SHA512 b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672
SSDEEP 768:aOX/jdsn7ZRu0lXLWWpFfQVGUF/swJ6olJezvFZ7jQVgoGuGQEPaa1A6X48r:9X/q7uQFcGes06OJQ8Vg5QEa+zXHr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 6936f567c4b7091fb2bad4081cbff17fc8fff2e539313e796bb135a504bb5bc9
MD5 25c3357e1adadf2b7ab390a020f15980
SHA1 10156ef45510a1ba63b7c712d3dde255dd19fb83
SHA512 91c27d53d7d29c204b2c4b2bf49b547fd42c1da2d04d2023ccfcfce248feae598dcd3133beca4d3c848c66ba67bb7b6313f7becb5f737fb2030549cf253e46b8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 f85db00caa5b207cc9b6c78de7c240f490680dc8b8b533272af7e444cd7c45bd
MD5 6c1a093c23b5dde538b56bc0e0f9fd22
SHA1 a67df52d3d7bfc07646d219fecb1b440fa427eae
SHA512 cccda72f82e23214db40648508371294c9a2c49dd9630cbb2ca75f9d899c151df5ee1ba7e6b1dbf4408a367e4b782698d41a41e7a5ff2e39f27258d1aea7590e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 aa840def732553dc916530d4735e977da81b01be4383820143db340eb5afe93a
MD5 7724117cd6dc31a6d5641fd9c5b68397
SHA1 04737b11f00109b3ae4e404177eb6cad6dc4d1f8
SHA512 a63cfce10f9bc70ac1ae62a7619087efd5e9b882ff7c731758aceaa0385e58faa051a65f6c376f42912b9b404754439b36f873366a01df938feff07f59007581
SSDEEP 96:JtiyC7C1GGXZK0GpGGpmytGp4z7CGJTKwOGxGY5S1E36rNIjA0tbY0kyabUGCGl2:JtdC7C1GQZVIGImytI4z7CCTK3Yv5SK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 c44073a1b5d1f01e690f49633d85c312175186bc74ffab8b1a25dbb0c7ba991a
MD5 801afc756820dd45b39d266960257849
SHA1 2d7ad246d4b827185fa1e62dac622e4162162ccf
SHA512 75501f9433c37d2f32db71861d0ce7cf0ea4e5809c51a5576b1699714f15c3075334a863baf01867c73ca0deb81acc2736261d853175d3e8b3f5be717ed2d4ec
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 034f0609d39fa9d5fc798b04118cae534d8997502856da84513ffb5d267166fc
MD5 939bd79afe4397e4828665571e2fbcc1
SHA1 47d42d4b506cf832968aa50751e4cdb6ac06cc54
SHA512 fa22cf6da677f532cdeb9ad11ad99af26713977468cdd5c4056a98e2450d10c0458de3ab0304a82f9495b9d8942042059bceed7422c6929c19dd3a615b0ad3de
SSDEEP 192:nOkx/L6BGWMbeGia9vPaq4WEjacHrHk2BKrV:nO+6kW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1665cdd70ebdbdc5f22c9714559f2ed4b0e61e3b689f93d60fa1edbff89a463f
MD5 64233497b0d3c9a2307551d0628694e2
SHA1 1b378153cbee298ea1d01547627ad0b43d0f8be4
SHA512 3a34cab224871944483b8c931b9611a5d3e14c668c41d18f6636a01cb9cdfbbd8c0dff9fe41f3aa0b9c2b40879fd1e060af45ca6d810c9b53eb79227db3558e9
SSDEEP 96:nOkAxm/BQYmqM1kaSwpvWMoiVmdeHBjsjUWQyV+VDCziEwb:nOkxKL6BGWMXBKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bbd157e34bcbee853d8b267e8f1ddb6ea9676ece40cccd8ac3f46463d3167fb5
MD5 4c9115893ce47156c46be1f3aa5f210d
SHA1 475e7d664e9b0e6f0fd29066b26c2f9065db594e
SHA512 c13d1298cdad1f0253429a6032ad6c65f9013f526639dc70ee248b12b0219f899fb24d213af0505358cd16c0dac6e0c5c5487953e025750768dfbc176c822eef
SSDEEP 192:nOkxULq3GWMbeGia9vPaq4Wtc0N1POgcM1k/n4HyErxE/RVjtx7D2BvTreX:nORqWWKfrCumX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 196f5b4d80ff997b15100472f863baa82e1b9eeff69fd3c7d01b28b9244cc5ee
MD5 20ccc9175c00213fa6611185f2ef54e8
SHA1 6432e3c6a4dc01b6e958f6f9b0914c25272d1e9e
SHA512 bbe80e025fe688b200378e30d9634f06ca98796ad35ad53615568150e6389b93273c553f9e96168caf8e89e35d5d6d27209f85911658f80541749965cddbe217
SSDEEP 192:nOkx/L63GWMbeGia9vPaq4WEjacHrHk2BKrV:nO+6WW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 e427d8bdfe1e6b7187c01fca70e9cb08b9a4a5547f17fe6defcf5fca874ea060
MD5 419a615bf5ad98cb1043d859767926b8
SHA1 cbe0cff3573c83d5aa800562a4162c311b6a3c04
SHA512 06b2b2c0b48d64caee4510b0be51736c15e2553e572f1a3aa4090cea2ba5df6535ca47420f497882fd9e29f635349064fe2c6bad88ca3b1744c7a71e57bc3985
SSDEEP 192:nOkxjL63GWMbeGia9vPaq4WEjazc+HrHk2BvTrg:nOe6WWWY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 48ab8b2ce9b49c3d7485d5e4e25ceb531d85a2ca40795c80fe81a13447143c63
MD5 81db7125dabb8fe9b9a0c09de2413f53
SHA1 5a780af88dbc4dc67dee561d7fad6ea918f5707c
SHA512 bfd978c7a6a37433ea78bfbbf2c5ab65ebb77d6f3d97b0c1bca98b26d935ec7546ecca299d39db004475e7b2171d33fe9d23970a550fc76bc5ebcc6291aeb488
SSDEEP 192:nOkxjLq3GWMbeGia9vPaq4WEjazc+HrHk2BvTrg:nOeqWWWY
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 170a9c912db2eae7995e6d8dbf0b63e888b20f1293ac1708abe4f12fba32dc38
MD5 43d933f6cfa724430556be803c0625fa
SHA1 fe697e8ac8ba0763561b69aa626c16cef21ff0c1
SHA512 799678cec2555dec048e1394caae4344c6bb3d41a0e94fd277984415c9b9892c442846a17b934768039ed24087f6aa2c75dea4116beaa494240f055696a5734c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 08daae2a118a9cecd75a54ada54ab189ddad63dcfc0ab884b7b666d35aa2b897
MD5 6fe7e894a48ef7ad8dcb038d3ffe6c5b
SHA1 6f82e30921b3dc05cc6e8b06cea5ada33e96164b
SHA512 13ab06d167a9200fc372e21cbd855122a47741c2bb33f46628619322511e9f500d584fdab6e829209cb9c25dda3ecc5fd95ab6f148e89e53dfc27c6cf84443d0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe587990.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587990.TMP
Size 873B
SHA256 2d16b2f553d9589017cc5a5f921f959aae88bd7acd17c393c196f1866a387096
MD5 ad80fc7f43b04c490514c059f4a3027b
SHA1 e04fb2af23a68653eceff45bfc978c8cb5e4f96a
SHA512 444cb74b471aebf5c7e8376065e357ed4247b0e0f04453406d43d93272ecf406cf7b7802342059d7418929f132922f586f6bb40c99aa04e9903de73f5081a21c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 2adfa5395f1e1bdb9aa9db765a763cd309db46d1dc4b40f8c187ec3a4942f61e
MD5 35756df869403cfe38f51f33034fd894
SHA1 dd2b78edfa5b6c871dc94df80f7d4287380365a6
SHA512 2ffb67ba09d2b55bf09ad4fe192cc0eedf72546ab747b40c4bab9a13492918c2f33decdb3ec56d94a275d79f1436cca7c614dbd3fb87b0d0ac0637e8f0efc168
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqe2RU5Ech86+B1EKTsu:A9iIxuERzA83h09RZxYkAwbE0su
MD5 SHA1 SHA512 SSDEEP

Submit Download