25b73f043d8236a1cc3e528c77630d7194e4ea532f5c39071a4da07f9b90a4dc

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4410fc043beaa9d1ca9d1b1ba3e1499a_JaffaCakes118.html
Size

80KB
MD5

4410fc043beaa9d1ca9d1b1ba3e1499a
SHA1

1bcac9e26aa530e9ee376b04b7ef0c3450bafb27
SHA256

25b73f043d8236a1cc3e528c77630d7194e4ea532f5c39071a4da07f9b90a4dc
SHA512

b0f5dbbaf7ff1742707c7b14e4e9441bf159d3c8de94980d4193dc798d94cb46af9fca410317ccdcae5d7bb1e971485c7634a805e0b33c12ca68f3b8d1684f52
SSDEEP

1536:qwgr8VSeO3x5PZut51NWaS6cgRrhFt8fY:UeO3x5PizNjnFt8fY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2260	msedge.exe
2260	msedge.exe
4384	identity_helper.exe
4384	identity_helper.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3192	2260	msedge.exe	84
PID 2260 wrote to memory of 3192	2260	msedge.exe	84
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 1964	2260	msedge.exe	85
PID 2260 wrote to memory of 2076	2260	msedge.exe	86
PID 2260 wrote to memory of 2076	2260	msedge.exe	86
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87
PID 2260 wrote to memory of 2508	2260	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4410fc043beaa9d1ca9d1b1ba3e1499a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6dc246f8,0x7ffa6dc24708,0x7ffa6dc24718
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12668657230654124741,9612843368397358242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:5884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
35KB

MD5
aeeedfb5c652fe157e093e3bf5bbdd10

SHA1
549e91287fd28e50fc3a13c4d32188609404e173

SHA256
efdcf4b39ba18c96804ff82a6ee1533cb789958de5a533a261d2d078bee4a1a8

SHA512
a277464695732e7ae94df557c9eefa1544df9ec233786ba83386f52021995848d24f255ff49920e50e403d9e3400fba28e69be6f4d8b631473a99647162a8693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
34KB

MD5
2cb0d055e696093d50e08ce867690ca8

SHA1
025881f588a52aa7c08e2085bdbeeee0daca1d7a

SHA256
f6ef7fcf9ffb95b022e372b4b3c9beb4fefd8dcd817cc5976b6d49eb1f4e1d25

SHA512
2a65e39848ec670f2465015f555bdf6f04b529b3d5449f70ab7349f57c6621ecfbb3da82ad6dcc07b300c6476f8f2a35eda35ab463ff9ff5acdd99a06a2c1051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
30KB

MD5
e99f1712e9ab2361d5bdeb29f499183c

SHA1
aa1ad85ed4ca152a807101ebfbf7636c49495236

SHA256
9d34a303f8c67d6d63830ae852e3368ec97c8237e82672fa2a144352d1ce9460

SHA512
686620842f086366ae8132128c7fd2e7037d2a319d975d5f633ba0160143567d10880e11027df2da4dbecb150991680c14a2773ba810c1560d69742344fa0e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
25KB

MD5
651759109c0101a3622ce3e8d4c98be5

SHA1
aa1838164412bbad08112a0895754c54ffd132d7

SHA256
01318a80813fcbf44ef73a52bdd7c85b69bef8edda8d63a247bf6db8e2068a06

SHA512
6313df038c265f147a5954d2ed69ea61431795e005cbf25dda05128adbe668a194c73322727c65201ccfda5ba2252fe9f6cee88b96485b85940b83254d0220e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
8b41d9e82bfaf51825f94b0bc9facf25

SHA1
9f988a1b5c14425843d77bccca491b419f115816

SHA256
c0396130b9807c0b45615aefc58fd118f64899622a1a15e5ee6a88ae3516704e

SHA512
9d1caa1f3fea8e19eb0b8dd6c131665d826bbe85327757f4469b3e41c3c5dc77b5f3ae8bb2360a3979b5607933f7d5f7064abd1f196f7729e4ee90b23571c011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
45KB

MD5
79c55102491a45acc28486b6d606492b

SHA1
1689f1a5f433e46529a9dfe0ad9c80d20c46cb70

SHA256
0752ba605369b9e24001686643a991114199d0b477e661bd0faef72f63cb9521

SHA512
5bf8666aa20df93e69affeb9edafb988cf57e9f738c9ff94db227564c2ec1e68d963a336e8dc27e54ae60dcfc1fafdca46f326fa80b3e3faf76e305ae781d73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
78cfa4bbf96276141cf4c31d78c0b2a2

SHA1
3ca3188891bfef7b38856bf44ab960c0312b4fd5

SHA256
da64955d50e6b08598b8d1d514364c6465bcc435597465945461312664b5fa48

SHA512
fbbdd119c7a5961898d18063b2326b5e7a87ded6261048b13bd2e443bf9c02fc79a420389d7334a57889f5e91ed27a9ed77d1ac7ab0f18f8ff45cd86b63193e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f4a9bf08d607c839f704d4f7ab6baeaa

SHA1
ca13f6f2b0d4cd4069155b2ed4cde74d2ff13301

SHA256
4ae9c25aa837a478d70550d36548c3017b5af93261ab3b956809ad8fe84ce9b5

SHA512
6973415ddc8d8cda3d637e7ed0dbcc9ac90a092c79382a6487505fe54f1d24f80900315ce9da7449eba501af6cb15026922c304ea8f41bc11c5f6bf0f871f78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
9f6c7e9f8ffa49e6126f572eb6551872

SHA1
88c9fa652e7992099c6feec22f75658dc86b9f2d

SHA256
211cede7bb46c5c9568fd73bd173f73b6632583b8f1df2663bf528e5d835bb92

SHA512
6b575b45b6cc5e3fc663b0bb6c8ec2c2f2d817f42d664e710dc2674beb72ba1ebe45cb34d83ddc6ce3cb64bd36714a5d70a0d700214c60c5425310e1dd424446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d4dec72a92448616ee1c2c0ee248aeef

SHA1
0c4a9237d7dca289a963427fde5c3fd3b7efb080

SHA256
211c980977a904fd4622dcdd9c50a09daba18c7dea80ec3241c367ae55868f0b

SHA512
7c7f091a92382db840aac77262b89e34cf9f8c4d9b2646bd062cad04ada755b2cd4343af0c2a39480aa06bb544bbe0fe87fe0aef74bd8d3e63646e89fe335065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84b1c737177d1bb079075c8279e40e7b

SHA1
1b3abe9cb5ec67ab658d3156fcc1a81454834c2f

SHA256
ce82a1ed03d5d4d6f187f54a1bc5f7fedde80eb9bfca04469c079f00cfa3e9ee

SHA512
32fa27b8a3f590972a3ecc9acf22ddf7c2ac3f6d29908c8ab1e51c106a404d7d2f1a4234ae1a18d1814141f2d52be3a2b7c8f576d98cee65524e5f42e8806be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4adbdf199814d3b6236e8367f7c33aa4

SHA1
87551b36ef067d97cdee634fa1f84e5e9ceb5512

SHA256
aa8733e4d9b3c8683934ea8255e1c5cd55d372ce22eaf573be557174f96bea50

SHA512
4f13c18f95210c7a63f23eafd2ce7166130fc86f91554bbdf118b34aa63dff731c847651a9b575534f96312dd48f7d0a9e1c54f7cf4f209b9983a3d86a1868ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c7033b5e70741669fa45773647512ee3

SHA1
9d69f797c869813e1908777d7c803980e84a9342

SHA256
173f5e3ac7012ead6c3257c34d34030b8bb7a741bdb1c1517f80a14ac0acbf75

SHA512
956eb0bcdbfba95c9715101e54f2a4b605aee7283562d19e1b765f0b609a89ac004a9b46caba1a450b3c132064caf260160c420a41cde2a32d71e520044319b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0bac47e4a18d76199f50a6d1c2badf6f

SHA1
0b2207c3463527a18e1f9caa94c0c0a2e4db02c2

SHA256
9490a5e4ab6e1e11436b67fa771f6bc3d22c40908fd69d0f68706dcd250b974d

SHA512
8e4bd369f7fbbed8d515e89e9cc3c741e35cd64b277dc6e941fefb0c9440a81bfa7c4215dca2a162663fa1eabdfb5cfa00b5ca2f8bf18bb6fb6131275345cccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9c48b7c7bee0003097c5f0ce0f06fe8

SHA1
e6149e35ca6990924506e7fab14bdc4374a234a2

SHA256
dcab8c5d887913b2f7a4a80f00b9ec030e41156a6baf3f486a1e07a29db54f93

SHA512
c4ca7f7b5ea1f7f6c0b7d9eeaa5a7e4219b953d4aab98b54797c2a0941410f0f8bfed2af1a5ce744d3e1a128e8abe062bb1038c30c1f9ce13632e560c21de58e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
366B

MD5
0b305922cdd0e31661215ddd4819c27f

SHA1
7721b9861fcdf22782a35758fbab9291797c29c8

SHA256
e5c254a6f3f676c37008734a389c7c1a7266e5fef4e34a6637c28c58faf7c5f1

SHA512
f015b19f083c4a89ff7b6f7f9162eb9c2b6098e24844a90cd015a673a800ff742fe20eb36ff08bbffc8154f3bf659714e4e651ce09bb5a88de062e95da36b991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
9fd588bf45f1eda88a0d673ce92e2014

SHA1
0ac4ff7eadd95d180860155eae7f6404d49007b2

SHA256
612922d2bf2d18ee04e05a9316efcefc992989c52760a973fc43356f7036821d

SHA512
5bdfd337f6f0eba179fc47919d6a71db338176806b62bb331137e3efa131e71c8a4d8e3a8a050cfc7a2719dfed73b270f7762eeb501afac0cf158e19756f2fde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d6d3.TMP

Filesize
203B

MD5
491e41a84f01ca10dca6d1df3cf14c48

SHA1
03f0b666fdbe0c1162581c76d534daea49586a4e

SHA256
0725863b670616fcc7cd4be77a5d0756f554011a67a2bd3d6f991217638f1008

SHA512
198f70bd327298c9cbe5ac399a1370145c7ac244329c71457279c1a15380d90d1e470b678c42ac9b7ff6a2a8ad23428101216c10bdde8ff758e9e39e1a015128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
83cfea58cdc0063be948b990f087987e

SHA1
a77a20dfdd65fb2096af21502f4f4c6f1a24c212

SHA256
9f602cff7d09a80bc617642f46afc338a50377fb6b527a484510db5ea99c08a0

SHA512
1d1fb16bbe8e4a2d68dd40a36b55fbe2424018a439e0573113da46145e2e8fa8c8e8ce9ae1f732530e4ec6838b28f1d0f77bc021db1ced534f09208773076539

Download Submit