stormkitty | 54541a6f3a056381ad7ef5660c7caee7a381dfd6c46a901341f41efcd85db3ab

Resubmissions

10-11-2024 17:39

241110-v79fvs1lby 10

10-11-2024 17:34

241110-v5rg9s1erl 10

Analysis

max time kernel
192s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XCl1ient.exe
Size

32KB
MD5

f30c403483be14f6fd70474ae2754187
SHA1

249d5a63bbeff68f41b7a861491e87533e7c9230
SHA256

54541a6f3a056381ad7ef5660c7caee7a381dfd6c46a901341f41efcd85db3ab
SHA512

ebbe62886441c2d64de8e74f8e88e0a504d70c07a5467fe1be0dd3a96428be52c0d493ba749dd34bae2e361e852a09a8fbfb52c3399e8e714467051d5daa09aa
SSDEEP

384:icmKc71F3BUaMbGf/JLbFUr3Tm2eaFO6lzRApkFTBLTsOZwpGd2v99Ikuis+VFxc:za1LxMC1Js3Tw4flzVFE9jdOjhgbC

Score

10^/10

stormkitty xworm discovery rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

mon-faculty.gl.at.ply.gg:37296

127.0.0.1:37296

Mutex

4SXJgYYYcCz7QcRn

Attributes

install_file
USB.exe

aes.plain

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/1868-54-0x0000000002450000-0x000000000245E000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1868-1-0x00000000001A0000-0x00000000001AE000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/1868-56-0x000000001C9C0000-0x000000001CAE0000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XCl1ient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	XCl1ient.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XCl1ient.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	XCl1ient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	XCl1ient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XCl1ient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3128	WINWORD.EXE
3128	WINWORD.EXE
4984	vlc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
1444	msedge.exe
1444	msedge.exe
4884	msedge.exe
4884	msedge.exe
516	identity_helper.exe
516	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4984	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	XCl1ient.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4984	vlc.exe
4984	vlc.exe
4984	vlc.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4984	vlc.exe
4984	vlc.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3128	WINWORD.EXE
3128	WINWORD.EXE
3128	WINWORD.EXE
3128	WINWORD.EXE
3128	WINWORD.EXE
3128	WINWORD.EXE
3128	WINWORD.EXE
3128	WINWORD.EXE
4984	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2252	2024	msedge.exe	108
PID 2024 wrote to memory of 2252	2024	msedge.exe	108
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 3008	2024	msedge.exe	109
PID 2024 wrote to memory of 836	2024	msedge.exe	110
PID 2024 wrote to memory of 836	2024	msedge.exe	110
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111
PID 2024 wrote to memory of 2500	2024	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\XCl1ient.exe
"C:\Users\Admin\AppData\Local\Temp\XCl1ient.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1868
- C:\Windows\SYSTEM32\CMD.EXE
  "CMD.EXE"
  2⤵
  PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault77efa6echf659h4b58h8528h05eae8c0fe77
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff408846f8,0x7fff40884708,0x7fff40884718
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,4391326032149880440,13342133018577269427,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,4391326032149880440,13342133018577269427,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,4391326032149880440,13342133018577269427,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ExitExport.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\InstallLimit.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7fff408846f8,0x7fff40884708,0x7fff40884718
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,8829919531406139133,812504240215648215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
11653bc135563ea466daff1882772382

SHA1
51317ff25023c9f49c7b9196f19dceba366e3595

SHA256
a014d201f4df2deb0a710bf9aa5ebcfe1bef9b900b185fbe12af15c8c044a757

SHA512
af2b67dd9dd714e505239c29187ce8cd59c9575937ab6526618196cac5773b01000eebf6a12b3b62afb4264ccdaaceb01595eb433ba0c94b0148addc6a5d764c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
64f9bce8b80091280b7fbdaf7972934a

SHA1
0b3c8fcf2026352450df769d61b184819845aefb

SHA256
6b7f8438e2f5eba1e3d5edcd0c87c09acfc7a33f464751c1623a169d7788665d

SHA512
f3307db3b168c6e4f8682164177fd9685ddc447553ad155a54dde9a84bee791b6e70172687257bb6a283cdbe4f2cec0235f242fd72a186475b02db0131ddfaf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5d7cbd0b8a90d4b690aa892ad01dd3ee

SHA1
de2cef3a878fa892ddbaa2df84f8aec2cdff8fdf

SHA256
87fc7ca0067b8538ef7430673298e6acd874c6b24d4a5c62f6bc6ebb96e1789f

SHA512
18c53879e39f32f371313b6b99ea2e720c072974105940bae56e5a3c62557ce9a23fccfdf930dd3169f6b292b68b1c98488def111313407d289ddae9598d5ac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
1fef7ecb3b99cd12082fa4404c0a0588

SHA1
4d546536102712ef57f12b68ff5f1737606ebc9a

SHA256
540c885ddd5d913a28b8bf233e86417d8b6706f918012932b116a2d5d0cd97db

SHA512
0f70e53c7c42632f3b79f9a0f1a7da6639dac83b7ababc144c1e1d42fa669d9cac328dd1ec9c622553da1f6a0e8b7c00c2d1f6b7d06e294fe5743a1c635fb189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d69c968c8addf70a5864a8177642d80

SHA1
7c0f951c3121439cd21c383e53051edc71ccca80

SHA256
6934bd94409a066375c9647b960acb32cc5d6a2f2eea1e0a85a8835381e9ac70

SHA512
c80e65f93d21fc8b40ac43f912d97a035e29fc1aa839d1ecc06dc394e1309fecc85b3fe68a97eb681ed40028a9ec170fa0cb12480f56b2af4a8c1839f6620214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7848b3134ab8d62f8f0c5981ccb1beba

SHA1
bd669b732d2dad820ccc4b5182e3291d40cf7213

SHA256
06acddab5efac053099ebe787e3767874438cac9ef0d6c674306091150930b60

SHA512
31bc5fdb5fe61921e89a729de422d945144ba6b6a32ed6678290eb46993e964d1e7ca1cec7dffa87d182bb0486a07a7df554c76872497ffca25cefc1f085ff7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
102b0a77466937e5f3d48a7ec112a7fd

SHA1
0f0028fc80ee855e1baf3fc226e02d9ffeb536a7

SHA256
221906674ede17b774b9852564c53978e8ad15fc7720a838c109dcdaf1de598a

SHA512
a801e09822998a83d478f4d601ffd589b776c08140e704600d6ab78d9da0d8a5b48287ded970a37f75b04c9683946de6c6241e0c0e75a5849dbc14cf2ac49504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
c70869217693ec751f8715db258971b4

SHA1
a7bff7327d78e82fb30ffe51cb6a0ede682e42ee

SHA256
713be1f8a5e5795eaa4891a845cc794a272b0d1649feb000ee4ad4955f4d9c31

SHA512
5599863f41c96485ae83acfb81569ceacb2de77e9ffa453a991f8170a6574e5fe1ea64e59206c1af7f94d075aef5356ecad645ee64750b083b7ea69434ed211d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d59ad5e55171bffcf3739239176b3728

SHA1
ce68b846bbe36014341856897d64529f2a2d6380

SHA256
f34ecf3f37cc5120a57157d59e3414942de7f78ee51d807d40ac560a741cc035

SHA512
cf2ac585a90b8c29f7155ee25c652966fcd07428e19201de910a1e15c976eb3eb5b62481ed560ff2834627366f367a01cdda94b965381c3446b81e59e6784d5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
6e47a92c1e16b06b5dde7772840b5eeb

SHA1
dfe024c26dc0d92dada7246e0ce7dce1c4bffe60

SHA256
e6a4e9c544c3ea65fd0b99328492fc35590298d2456f8e6fcdc8f58f85889a62

SHA512
53d186256de44c48776eed8b66eca6a21c98ce0f7bd33968c5869017c2f7ff81471100629fd958625878e0295d681e1d12e7d68841e74067025217ec61c02304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
2ba835239fa2d6a1ca84cda814c86768

SHA1
970f28a62ecbd5c29a2119256df595040eb5931d

SHA256
7de17ab99313a83e3f926a34e531b7167cd1cc087c622fadc8b9229429dac165

SHA512
1c6ba1c23d564c431b6c21705acb8ca421b96e0273b2d0644061945493bc546b22b291eb92ac534bfdddbb6ea616f239b9b772e6eaf03ee4c2d9728643bd19b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
248B

MD5
651c78b85a97f09d1ad2fb265d17416c

SHA1
e678d454b5a8546b07798ca888796b45c21171ae

SHA256
63dbe8309b6324060e10e2d2ba96db4d68f7f71ad0dc468296b9b33cde8d64e2

SHA512
4b780faecf3fc09d0e68cd5af053bfd44afaee4195f25525dc88415d306026eeafa17c375f78e0a770d859a9e347d0fdf7b8695ff24cad710a6822317654c4f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
266c28411f70700613122978d6a73bfb

SHA1
2152d6bed53e142fe0fb9ae6ddc351e81d4d0db9

SHA256
fbde6e86acbe436258a7aacaee9612c32c108e4a7070c1b4ab04f458ca59ae18

SHA512
e0a47c69e2f9df0cc392334296bd390dc5da9bf1394fb523d408024fbd49b2f0d5965d5f106ebf6087f3541786a61c3d38f65f0764f64cb0681740ce1eea3fd7

Download Submit
memory/1868-96-0x000000001ADF0000-0x000000001ADFC000-memory.dmp

Filesize
48KB

Download
memory/1868-99-0x000000001AE00000-0x000000001AE0C000-memory.dmp

Filesize
48KB

Download
memory/1868-1-0x00000000001A0000-0x00000000001AE000-memory.dmp

Filesize
56KB

Download
memory/1868-2-0x00007FFF48350000-0x00007FFF48E11000-memory.dmp

Filesize
10.8MB

Download
memory/1868-3-0x00007FFF48353000-0x00007FFF48355000-memory.dmp

Filesize
8KB

Download
memory/1868-4-0x00007FFF48350000-0x00007FFF48E11000-memory.dmp

Filesize
10.8MB

Download
memory/1868-54-0x0000000002450000-0x000000000245E000-memory.dmp

Filesize
56KB

Download
memory/1868-55-0x00000000008A0000-0x00000000008AA000-memory.dmp

Filesize
40KB

Download
memory/1868-56-0x000000001C9C0000-0x000000001CAE0000-memory.dmp

Filesize
1.1MB

Download
memory/1868-95-0x000000001D010000-0x000000001D032000-memory.dmp

Filesize
136KB

Download
memory/1868-0-0x00007FFF48353000-0x00007FFF48355000-memory.dmp

Filesize
8KB

Download
memory/1868-97-0x000000001D570000-0x000000001DA98000-memory.dmp

Filesize
5.2MB

Download
memory/1868-98-0x000000001BDD0000-0x000000001BDDA000-memory.dmp

Filesize
40KB

Download
memory/3128-172-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-171-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-105-0x00007FFF23D30000-0x00007FFF23D40000-memory.dmp

Filesize
64KB

Download
memory/3128-106-0x00007FFF23D30000-0x00007FFF23D40000-memory.dmp

Filesize
64KB

Download
memory/3128-101-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-103-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-102-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-170-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-169-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-100-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/3128-104-0x00007FFF26690000-0x00007FFF266A0000-memory.dmp

Filesize
64KB

Download
memory/4984-177-0x00007FFF58080000-0x00007FFF58097000-memory.dmp

Filesize
92KB

Download
memory/4984-173-0x00007FF6D3790000-0x00007FF6D3888000-memory.dmp

Filesize
992KB

Download
memory/4984-174-0x00007FFF5B790000-0x00007FFF5B7C4000-memory.dmp

Filesize
208KB

Download
memory/4984-179-0x00007FFF58010000-0x00007FFF58027000-memory.dmp

Filesize
92KB

Download
memory/4984-182-0x00007FFF3C5F0000-0x00007FFF3D6A0000-memory.dmp

Filesize
16.7MB

Download
memory/4984-183-0x00007FFF51FB0000-0x00007FFF52017000-memory.dmp

Filesize
412KB

Download
memory/4984-181-0x00007FFF57FD0000-0x00007FFF57FE1000-memory.dmp

Filesize
68KB

Download
memory/4984-178-0x00007FFF58060000-0x00007FFF58071000-memory.dmp

Filesize
68KB

Download
memory/4984-176-0x00007FFF5B730000-0x00007FFF5B748000-memory.dmp

Filesize
96KB

Download
memory/4984-175-0x00007FFF43710000-0x00007FFF439C6000-memory.dmp

Filesize
2.7MB

Download
memory/4984-180-0x00007FFF57FF0000-0x00007FFF5800D000-memory.dmp

Filesize
116KB

Download