eec36382f8d0dc89a06fa90e0526fa719baa40790768a82f7a860c1ff923f504

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe
Size 1.3MB
Sample241022-ffkabszgrp
SHA256 eec36382f8d0dc89a06fa90e0526fa719baa40790768a82f7a860c1ff923f504
MD5 68f99426f393bdd4f02854b7be52ff92
SHA1 c4a337f380b37a28cd678db6fc1dd8150849366a
SHA512 02cd9664e2c6b5fe58d47e4d4c0b3a4259bfd8e28890d360709cf5604813dc0b9d2f55b25649155b11a2d662598cae3a0061bed40f07791cbf5f2b5a4ff97114
SSDEEP 24576:NrJKUKCvzuei/bc6EGn5u5TtyJ8adjCzjyhhcDkPQcKiwMH5yUKc5thLfrXa7sj0:N1Kbazur/bc6/nRJ/aOheDkPQcKiwMHX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4740	crpB854.exe
1052	hpet.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json	hpet.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crpB854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpet.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896"	hpet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341"	hpet.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
1052	hpet.exe
4732	msedge.exe
4732	msedge.exe
1576	msedge.exe
1576	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	4740	crpB854.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
4740	crpB854.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
4740	crpB854.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe
4740	crpB854.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4740	crpB854.exe
4740	crpB854.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4740	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	93
PID 2836 wrote to memory of 4740	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	93
PID 2836 wrote to memory of 4740	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	93
PID 2836 wrote to memory of 1052	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	94
PID 2836 wrote to memory of 1052	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	94
PID 2836 wrote to memory of 1052	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	94
PID 2836 wrote to memory of 1576	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	96
PID 2836 wrote to memory of 1576	2836	68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe	96
PID 1576 wrote to memory of 3488	1576	msedge.exe	97
PID 1576 wrote to memory of 3488	1576	msedge.exe	97
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 5028	1576	msedge.exe	98
PID 1576 wrote to memory of 4732	1576	msedge.exe	99
PID 1576 wrote to memory of 4732	1576	msedge.exe	99
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100
PID 1576 wrote to memory of 4456	1576	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68f99426f393bdd4f02854b7be52ff92_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\crpB854.exe
  /S /notray
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4740
- C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe
  -home -home2 -hie -hff -hgc -spff -et -channel 162341
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/mp3/z5Yo6Jxl/02_-_Gabriel_Gava_-_Vou_Sair_d.html?ref=downloadhelpererror
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7bd246f8,0x7ffa7bd24708,0x7ffa7bd24718
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8915208991976586484,10118994935935609431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5bdadadd7d16c625529fe5c617f69e4c3330670bf03f82f376740c3fc7754e12
MD5 bdefddca7ff3e4804f222fe82f380214
SHA1 cf4c984b992d9057c42f0380eb510b6431943198
SHA512 18d55a6443ac8090328e9997b585fa4bcb95965f69b38fc111b4c8ffc355af2dceb5be9c5709f2443949c4008dd1df1a0789a360fe9089e7cd627fcb8109695e
SSDEEP 96:nMk+m1kR1SnwpvWMoiVmdeHdw9lUWQyV+VDCziEwb:nMkxuzaGWMXilro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0ff557ebedbdea2dec896717ba2428aced3b360d65f16f69c72803d5b8881526
MD5 d9bd0fa845307dc8c0b86c25725057a1
SHA1 7c60cf43d00b17508109a2f3df309dbe3adb48c6
SHA512 a832a94233015f3fe154889dbbceb06ce33cc5f87d72e95f0b3648ecee4686e75a18b1ccc87e48bb732f8007924bb09a2d2351510adc4b543d75b85d6d84fa17
SSDEEP 96:nMkIm1kR1SnwpvWMoiVmdeRuq1jdR9lUWQyV+VD7AiEwb:nMkfuzaGWMBuqh1lrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 935430d71ed61162fc2c98d9bda2ec68dfd6c8f982f7e8300e4d364148498cd1
MD5 3bf03979cf188027073754a19c331926
SHA1 db1379fb4ba2535d4cfad3685576f2a626d100ee
SHA512 c3ffc8e0f6c378ae1e6a9992df201217f87e893ef65d42af7b85aff28a01a0cc9d267ed5eb4a67394b2a0974c67a6f016882e191b1832cde0356c94faf483311
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvg2te2RUqRHx1K3wkUgu:A9iIxuERzA83h09RZxYxNLKEgu
MD5 SHA1 SHA512 SSDEEP

Submit Download

crpB854.exe

Path C:\Users\Admin\AppData\Local\Temp\crpB854.exe
Size 804KB
SHA256 6b9d76eb7947fb680fe13c36c0614e802cb6cea4fdaa69e54cece0416f333b7a
MD5 dc61ef7550384b682a212cd1b7224cfa
SHA1 554f45ce56845471fb27695d62d63083b3f9eeed
SHA512 af8923c9af7244ffe4edf24266d19644a70a8750f1ff31562b97879832365575db4279339d2f9101407b166310c8db1c5538d23331e3196226080d1a0ba52e0f
SSDEEP 12288:mAXSaD3HkJ1XB7bjxWWLUSeuKIADOqva0hxnAkoHFCs+ngLGPzFfXp8POu:JAA3xnAkoHFCaCpx8POu
MD5 SHA1 SHA512 SSDEEP

Submit Download

hpet.exe

Path C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe
Size 331KB
SHA256 3a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6
MD5 a3e93460c26e27a69594dc44eb58e678
SHA1 a615a8a12aa4e01c2197f4f0d78605a75979a048
SHA512 39d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530
SSDEEP 6144:+gB0qTrLEwdAuqmDhTz8LCL0LlocTB0mg/IGBTqhzAN2:drLEwpqmDhTz0CILacTqmg/yA0
MD5 SHA1 SHA512 SSDEEP

Submit Download