61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42

Analysis

max time kernel
146s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20/11/2024, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Atlantis Exploit_07486690.exe
Size

5.7MB
MD5

15d1c495ff66bf7cea8a6d14bfdf0a20
SHA1

942814521fa406a225522f208ac67f90dbde0ae7
SHA256

61c2c4a5d7c14f77ee88871ded4cc7f1e49dae3e4ef209504c66fedf4d22de42
SHA512

063169f22108ac97a3ccb6f8e97380b1e48eef7a07b8fb20870b9bd5f03d7279d3fb10a69c09868beb4a1672ebe826198ae2d0ea81df4d29f9a288ea4f2b98d8
SSDEEP

98304:+j8ab67Ht6RL8xpH4Tv7wPV6osBsBpPj7cZ+KCojTeEL78rqNkIi+bn:+j8aatLPV6oPrk38rqNj

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Atlantis Exploit_07486690.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Opera GXStable	Atlantis Exploit_07486690.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Opera GXStable	Atlantis Exploit_07486690.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	Atlantis Exploit_07486690.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Release.rar:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2620	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3112	msedge.exe
3112	msedge.exe
2196	msedge.exe
2196	msedge.exe
4352	identity_helper.exe
4352	identity_helper.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4264	Atlantis Exploit_07486690.exe
4264	Atlantis Exploit_07486690.exe
1144	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2620	4264	Atlantis Exploit_07486690.exe	81
PID 4264 wrote to memory of 2620	4264	Atlantis Exploit_07486690.exe	81
PID 4264 wrote to memory of 2620	4264	Atlantis Exploit_07486690.exe	81
PID 2620 wrote to memory of 3112	2620	NOTEPAD.EXE	82
PID 2620 wrote to memory of 3112	2620	NOTEPAD.EXE	82
PID 3112 wrote to memory of 3320	3112	msedge.exe	83
PID 3112 wrote to memory of 3320	3112	msedge.exe	83
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 1112	3112	msedge.exe	84
PID 3112 wrote to memory of 3476	3112	msedge.exe	85
PID 3112 wrote to memory of 3476	3112	msedge.exe	85
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86
PID 3112 wrote to memory of 760	3112	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\Atlantis Exploit_07486690.exe
"C:\Users\Admin\AppData\Local\Temp\Atlantis Exploit_07486690.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=873217&q=http%3A%2F%2Fa.directfiledl.com%2Fgetfile%3Fid%3D07486690%26s%3D6762AEE9&form=NPCTXT
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff16c53cb8,0x7fff16c53cc8,0x7fff16c53cd8
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2924 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4796 /prefetch:8
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
      4⤵
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,4927972482820985021,11988073320373288107,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
476B

MD5
a73a34dda8250381278e80ce347f0590

SHA1
370e631557a0276b9a630705bdad3e0b9e4225fe

SHA256
90f5ac540ad8db2681ac253e53497eae149ba69695a95d4a75cc360a9bda24b9

SHA512
e694d3d4de8381cbb00c426916bcc588661fdc500a8a7497db261eecd582e3388361adc42f88c77f4150ca065fcd152ab3f2cfed62f4694ebd8b1a4ccc31de23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3af35172eb5a9c06e8c9d111bc12dd01

SHA1
f6898616414a280e33188296de961a5459c481c1

SHA256
f99abdc13dcb7d1533547fd92da1f7fb86f7ef9a336227cc0135650cf75dae7e

SHA512
ee4ebe9f3eb43b23da0c50171a9a8bcaecdbe208b98bc7904ff846ce344d3d9b05ae677d00be157052b40b405776b511cb6e7216e23d62684b5933a26b04ee5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61502693c49b42e0d779b9d03cab99d6

SHA1
62070ca279968a6adaba697cce8a95deca15314c

SHA256
dc34c2e28832addbde20f2645ff67e1863ac56158a714c4deb4f7bc6824cf142

SHA512
6d95036f75a292e9b2d0a83b36a9abdf107c55cc37a98af642da262aa26ac7fb5ba74d322981ed98ffab729c6f960bb41ae123a8655c339d29614d70beba2d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
481cd3a37965d7caf2d5313148bf5fc9

SHA1
325e1b3845132bf7b22f0ed342ed4ba312b2605e

SHA256
63b21d6fcfbdfc5626acc6dd4c7c0bd9b680d90d41d217489ad2aa6c5fe4dd29

SHA512
d152d32f097cc6a1ce43dbf25fd92353015fe75f0b1fcd5c96f875be1b4aa6c1b0d761138f9921dbd4bbe70fa2d542b1df5f11c63b442c5018d5dd78f30ed418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bc8c9a7eca21e1bf4cf1da01ff430ea7

SHA1
623ae5c1ab1779ea4569a87e0e36bb4d2099e49f

SHA256
4b07e78903af39016a6f85539f33a782a0f01213e6e40dada1f2d904abad270d

SHA512
fb8ed109a24c630d20492a05ec452be08a80ea5e59326d622843a79b9491039c385d7aa9dbc8630aa35d9bf9e4a4de007cf86c45ea6e5dc7c1597452813e92ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5f78c239ddd32fdf7eb43ec17c9b2bc0

SHA1
d50d79bf854cb596dd1f97a9de1454112ba65d77

SHA256
8d81edafab4effa8e70e4588b07c55ef6a91056ddfe1ecc761268c848b193d0f

SHA512
575ab9981e2089a5fb179036c70dc75f70a96420173ab118a247e4c06e6707d30ba887e4411ea24dde9a42a526dbfebaf86dc089251423b364896541d977a095

Download Submit
C:\Users\Admin\AppData\Local\link.txt

Filesize
57B

MD5
1555b808b8673ad8035b9f4e40538604

SHA1
dd678e95d231735510936a953eba4e6b16232339

SHA256
56191f7ab3c2ecad46346cad1c429d9abb523a8b57aacff6f09563820cf53fe9

SHA512
4b86e046c2c753d11cc5b1f782280c10204aac749db2a3420c19f0973cafb4fc7580215c94aa0948764f3d6ff6fec489c9abe5246a338dd3de29e0b1ec0d2dc0

Download Submit
C:\Users\Admin\Downloads\Release.rar

Filesize
1.9MB

MD5
99fb762746f8719f4421e1a897cf7846

SHA1
c4dbc0fb0c4c21dbdc61e2202162363d69092c8d

SHA256
2a2d19d053252c1d42e4b7e6119a443b08dabee38f18aa6bbff4e0b730275a5d

SHA512
931c16b5b4b1731e869a9ac4c016cfd02bf8c23c5f64b76621473bae449925e64bde1a6204ff9e51c439ac99cd47e7b6766babeb916bbffd9ec88cae944c7a56

Download Submit
C:\Users\Admin\Downloads\Release.rar:Zone.Identifier

Filesize
92B

MD5
8b14b921a0215611e1f4a50209f47d99

SHA1
4459dbe10c9a3fead2bcb1cdbcccc1c25cc998bd

SHA256
dff74c987001574675efefe71af295f7a0b059a5c4d463713f3f906a4423eb88

SHA512
5d80455a6977bea3dcf4dc107e52f8503b50fdff4411d1730facc1d46a64acce42f5cf142fc34cb1611d0c658502c061abfc64f2becd366026d1a31e688ffd53

Download Submit