746d5bdbb22f05f753c27c7f54768710e734258e730149f631666f1ce0d97045

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43c75da5472aa163690f55e3e4efa151_JaffaCakes118.html
Size

242KB
MD5

43c75da5472aa163690f55e3e4efa151
SHA1

91d7d46c54aa9b1326736ee77e5487c445b5627c
SHA256

746d5bdbb22f05f753c27c7f54768710e734258e730149f631666f1ce0d97045
SHA512

cbab9affa3c0a69494d2bd057f56a3251f33acaf3b27cda97974ceecfcaefbf424d32642ab8b1b0275bec56108c4bcf48c929ffa1993546af812a04f51f95841
SSDEEP

3072:14f0gOS+lOzb9dVodYhMFT+PIPzKjmaLH9ZCroYna3vZSP5ZbI0ty/derD8f9Ei1:14cgDJ/94+0Nax9YDPngfLwZ8Z

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
76	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
2520	msedge.exe
2520	msedge.exe
2936	identity_helper.exe
2936	identity_helper.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 5100	2520	msedge.exe	84
PID 2520 wrote to memory of 5100	2520	msedge.exe	84
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1636	2520	msedge.exe	85
PID 2520 wrote to memory of 1404	2520	msedge.exe	86
PID 2520 wrote to memory of 1404	2520	msedge.exe	86
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87
PID 2520 wrote to memory of 2992	2520	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\43c75da5472aa163690f55e3e4efa151_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac5c46f8,0x7ffdac5c4708,0x7ffdac5c4718
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8315014012270600980,15917048818850764731,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
89b4592e046352b43622d7b70fed1db1

SHA1
9d9c1a7db948aeeb11378e643ebe3e3d35e01262

SHA256
40291238d3253cdc10fa1688a43ca436fc56dbfd9b9e4bad14644b103773ffec

SHA512
9424f5803326980d6778a844132cde1902bf65c498861f48af2a51dd5e861d4bd211fe71c976b3c855c989df32eb9a1f39a580a8836dd8b0147c329d411261d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
b129c10add92b3c114db66c80916fa38

SHA1
942911f7f5d5f98448ce0e1901589934979db9ab

SHA256
e86779fd1950443b17204e3234e7f2ffd43d497a713554cffbd404776218710d

SHA512
d9530d5abe99549b160629758c9cf65fab57d5470e270fad547c615045df17cc176bf367dbe39eda8036857d0f441ce13e88bfe59d3db737ab35a4ab4fac8041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ae8fa1083944fcfed650177ac9dda03c

SHA1
fa65fd07d74ecf61a4ceb56e502a06ad888618c7

SHA256
62a887c7bc91d307f45f0a46b409588826e21f871f0184c09d5d365ebea1275f

SHA512
d507cea0180dab101e27a15f9dd2c1d1902d41b83f3dfe849dd042286c14ee0f7fc60057fb596379b949cfafa7869ac35908122a4e3ffefeeee9075870c69887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91548da847fe7caf84e935a19e1505cf

SHA1
e6b8d68a8f528beb08c1deb1b19760b83abd95b7

SHA256
ff1197c16f69089245577ac47a1c30938c5197e8b9b8b0aef706a2872c712217

SHA512
51b605b109611ddcb1f12d3e52b266ec89970f7e50943637d3594423457790b363855161fa5f27c90d7059608fca945860b75fe0834924c5a1b5a34147f2bbc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f1c44ff4c6362cd4d6bf9fa215f23175

SHA1
b56bc23bf102a57329ce43a7405f2f82d19b6789

SHA256
cdbd12eea00ce456542bb8ecf5ade629799d6ef3feb9398fe6c434d6180c89c7

SHA512
7950fe077566874f3a4df80776da2087fd5e7fb9c011723a7a50554d6dd4b615cd5331ecf014c3d820c7e622705121f13a601ac4ad5248389c7b0729574d11d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0e27bdcb53c48ea2c971470af6f9d675

SHA1
74c88de159e3a5d07b8cd4a010a3f423eae08363

SHA256
9542382274e7fa90fb6e3647a85c5a6b64dc1ef1d35967beff64c88dff64e6e6

SHA512
f6bc4ae3c789ea4a89f59c00aca03a1ccb75d6369791609efe740d8a35605636dd3dfbc54cfd04836abed0d0686d21a5fb7264fcb3839b0eeb251ed54c306e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ed97c6cb510e9ef7fbdd047b8b7c9f1

SHA1
980372073779bea8b6c153debfa77d834cae0777

SHA256
7f75a7cdf04acf8694ba00b5325b54833a5b765ccf28f8ddde4753851c2de9f5

SHA512
5cf4437fa6dfa4b6216e01b69c5839fbb6b12d93ae8ab61e501d05c23a7d156a966f09f312ec888cacfec3560a88ae13fa8adfa8ea658140ee4cbce9ed6a3d1c

Download Submit