9dcb53352730371b688998699f6ee248ce732ba7ab31fc0fbeed5ad75af43173

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe
Size

1.3MB
MD5

449fa0a171a7362504184fd4adf63feb
SHA1

9c60c01056e1ebab238d8b445179967858c64c63
SHA256

9dcb53352730371b688998699f6ee248ce732ba7ab31fc0fbeed5ad75af43173
SHA512

1718bc873cbe5a42456e666fe66efafdb024136d1004ae72577ac42dc0058f224e2eb33061b1956d45b9d6ffc05f8ba990b3171ff558284dedaf28c8242a3be9
SSDEEP

24576:frJKUK/juqkncxnfS//2oYP+ENxuIW/Rjl/lVlP64htKQtsVELVDiicYQRebMyHz:f1Kb/juqgcxfSE+HIuRjl/lVlP64htKB

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3112	crp950D.exe
1588	hpet.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json	hpet.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crp950D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpet.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
1588	hpet.exe
2172	msedge.exe
2172	msedge.exe
960	msedge.exe
960	msedge.exe
4628	identity_helper.exe
4628	identity_helper.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	3112	crp950D.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
3112	crp950D.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
3112	crp950D.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
960	msedge.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe
3112	crp950D.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3112	crp950D.exe
3112	crp950D.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3112	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	92
PID 1680 wrote to memory of 3112	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	92
PID 1680 wrote to memory of 3112	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	92
PID 1680 wrote to memory of 1588	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	93
PID 1680 wrote to memory of 1588	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	93
PID 1680 wrote to memory of 1588	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	93
PID 1680 wrote to memory of 960	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	96
PID 1680 wrote to memory of 960	1680	449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe	96
PID 960 wrote to memory of 3176	960	msedge.exe	97
PID 960 wrote to memory of 3176	960	msedge.exe	97
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 3460	960	msedge.exe	98
PID 960 wrote to memory of 2172	960	msedge.exe	99
PID 960 wrote to memory of 2172	960	msedge.exe	99
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100
PID 960 wrote to memory of 704	960	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\crp950D.exe
  /S /notray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3112
- C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe
  -home -home2 -hie -hff -hgc -spff -et -channel 162341
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/file/9q0PlJOb/Finder-CWM.html?ref=downloadhelpererror
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe57b046f8,0x7ffe57b04708,0x7ffe57b04718
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3228 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80e133039508bae13bbeae7675cb3791

SHA1
28a0c2a6d9d9bed6e4f8f73001587bff6454e8f6

SHA256
f9d103e665a609e8842ccf9628c655a69da96a46cd5374ae580349b5fd2f54a7

SHA512
0bb418ec3ab70b61fda32c787984e90b9fc1dc66914940027699b1d2e80c98376685707586f7b414668e4e3b47580dc7f96dde4380ba10a558f5e5ff20746612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c5c49b551eb6babb317042977e6985d

SHA1
3fac9a9958889ce898ed996a96bae7ee8ac37497

SHA256
8a7bd04e44df5b30701c32306ea9e383671826bfeaf9cfdfe7f8298824d4b350

SHA512
93a85b5b59dc1fcf644acc56a5dffe1f5cead3c090f379e2f4ee042a9ddb249e86e54fa99b36819447530678b4c5f9db05473adfab29961abfb5cfaac5648894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
83defeac3f43aa306ba2a65fc7e5a373

SHA1
452dd53e704cde96aac7414602c09c18d453ef14

SHA256
9ccb3035c42306c678b04d38b94958649539b6a88bffa3774f952433a8c57887

SHA512
1d3f5fceb804c1e711835553366b2d48dd2da87194a0f44070d9944d7abe2cbdd8f705d35e63019a5365517a5740069f801df904ad215b32b77ddaec73658e45

Download Submit
C:\Users\Admin\AppData\Local\Temp\crp950D.exe

Filesize
806KB

MD5
661cf9c90eb099fb7b6a394dd8cde2e4

SHA1
3704e119ea16a3c336f63dc808176a22fbb8582a

SHA256
1570e0efe0cb98623913d942cf40f2eb5b10458f49842097125c6d6d8604cd07

SHA512
13c26a514c2022a10b42566a527ef98adaaa9932ffd07612ccdeb371888c037be3b429c956ecb7705699a2b6e3463758735332c9e26ea5f4493a91f30dfb4761

Download Submit
C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe

Filesize
331KB

MD5
a3e93460c26e27a69594dc44eb58e678

SHA1
a615a8a12aa4e01c2197f4f0d78605a75979a048

SHA256
3a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6

SHA512
39d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530

Download Submit