7b229b284e726a270320fb5671765b147cc698a0b2fa9f2dbb1f84fbcdb49942

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc194a2b502e42b68b058bbd401b723b_JaffaCakes118.html
Size

58KB
MD5

dc194a2b502e42b68b058bbd401b723b
SHA1

d7bb1751a8433eeec9232ec50ea3aa0b63f14a34
SHA256

7b229b284e726a270320fb5671765b147cc698a0b2fa9f2dbb1f84fbcdb49942
SHA512

21f13f394e816180f2ab8ad84a9c09fca933e99dcd2adea3065ce3d5c92150f7614fed2ee61eb1e2fcaa5cf518ce1186c9146c73de681c2e61f863eaa6690172
SSDEEP

1536:Hswgr8VSeO3x7WFPvOi/tLaS6cgRrhFtCaYG:KeO3x7gOetynFtCaYG

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
3296	msedge.exe
3296	msedge.exe
3664	identity_helper.exe
3664	identity_helper.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe
1224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4152	3296	msedge.exe	82
PID 3296 wrote to memory of 4152	3296	msedge.exe	82
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1524	3296	msedge.exe	83
PID 3296 wrote to memory of 1700	3296	msedge.exe	84
PID 3296 wrote to memory of 1700	3296	msedge.exe	84
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85
PID 3296 wrote to memory of 2624	3296	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\dc194a2b502e42b68b058bbd401b723b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2046f8,0x7ffa5c204708,0x7ffa5c204718
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4678876430920898401,14147939208612386754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:6088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
71KB

MD5
da52e38c98b0f2047abeb07609608ab5

SHA1
da1210caff36df73e49a0c271ff7d573c2d20d02

SHA256
726a2ef49785eaecce64e98fcb3490c40db06d6a205455784f3267a5b4b7c34b

SHA512
35adf36acd8e1c65f040663d7a064f642a6db5e0b7978241db8a9b4eb52b8ae71cef4e7bb1b4a0d85e4af1f7240d6d52e5a07f512e5e90504e063e51376b5f5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
61KB

MD5
468446a7240461af44b59ebb2047c231

SHA1
47b7c525dc91bece99df0c414960b9490b986ba8

SHA256
ae1a0126552472d1e1347ceb8027ed725db3b93fcbc0b39745a92412cc1641a6

SHA512
ac8cdf824112a3d25248e58f05495b458038d9388ba7e46e1ea8f6933cae23f044f4e532b74b13f52812bfaf602ca12ec152e44ce95266abe7cd6bd66b4a70b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
35KB

MD5
aeeedfb5c652fe157e093e3bf5bbdd10

SHA1
549e91287fd28e50fc3a13c4d32188609404e173

SHA256
efdcf4b39ba18c96804ff82a6ee1533cb789958de5a533a261d2d078bee4a1a8

SHA512
a277464695732e7ae94df557c9eefa1544df9ec233786ba83386f52021995848d24f255ff49920e50e403d9e3400fba28e69be6f4d8b631473a99647162a8693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
23KB

MD5
1ff53dae34c4555156d935d6455b5e8e

SHA1
7b0d480ae156810635d33de2750d7de405c41c62

SHA256
b60890e621ee1f1885e164572c092e6dfcaca3d7c7e2b6cbf65b5acbfeb6a998

SHA512
103de10e245e4eeddd8611d30f62a74b16b364b5aa90c866c1d239649363e42cce013d83520b7e3fe2c17ca709421168f78736477e124dfa841dc021f512bd1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
52KB

MD5
15cd09b43a09f2b52c56d9b83ec576c9

SHA1
c85a6ec788bf291348cd2c89eef346b68c12d38b

SHA256
6361410ddce0fe1600ec899648c8f731095850ce6f6a49c08b1558016308dc1c

SHA512
a00c2e1ad5ef5a52ea75804b3226873a9ee20506c475b0ee07d8415561ad19839b4dec31485dc804e514dab5e0c79a8b15df659dec0263699efa0533d9d31016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
6fd95c6dc537a29cd2ec16ddd181d30e

SHA1
833a0f183cdad0d5cc699bb187381189ad67f8e9

SHA256
690b31080dab6ad1f34029e0b2a93a7fffa03adad6f54f7046071fc04f77ed5a

SHA512
ba06d1d56875dc033411f0296a60a753e2326a36aa60a07cae1df471e74cc37e7591db78c565bc14be7568958b1c5255a3300b19c3692235c3468cbbe59a953e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
614408f7b60b473d6348dca22cd66e92

SHA1
a2c89e2659d9bd7c8ab47dc62a491158ff5f46fd

SHA256
0a34e6da8aee79ea20fe45fbbcb08d1d2e43e752c6c2956921d2724d82ec700a

SHA512
5605ba004b2297f90f165776bae74954d3c70714598dc11685c2e6f5df5110405926757de42f15ed59c4e9c71fac32ab6f6ed8697011390990ded3b260d56910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d1b699e64cca2d8a629d753869eeff37

SHA1
633bd398bbabecdf427b147e16280e1a1f596ce1

SHA256
9c05ee3cb79c94f5aea89ac82f1ebd502fe73987cc5d0e9c0241b6b7b9cfaa98

SHA512
9fe950301364fc820bd2fe64170a2298772e18c602a1f35e2bfa397923ce735a383d7fa4cfa669cde0bd9e7a5b7f3898645b093b027fad170567ead4133df3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1018B

MD5
f78cdf9415994bcbb76cf6437b70fd36

SHA1
1342a3ac86dd5c0155e031ed78c6effc12c446ce

SHA256
bb8f8cd346e142bfc5767e867cc5ab650fc3a38f764f5d7d84b3b92dba2bed3f

SHA512
2ca3d0f25b942e451c22f3279fe66fa60a9664c805c0eca83bc937dad5c4a3db77ee2f4a5f9ec9027302a79c9ba56b39931d3c8dac3e4558be803fccb00b3a8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b89679a0aa4c81b43629ef12d43afb17

SHA1
612185d1aae4a7051a796e1487d870f383a7459d

SHA256
f4179029a5f668503c49a1716cb4afa1a235bd251dfbba12b78813398b1bb6dd

SHA512
7ec4346e19e1578dd34312d61ffc906c9fe16bca85946e045f05582a99cf11b9db3240413474b6b60b5f997509d0dfe76a7cadfb1a33093eef43fff43aad8540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6339863e13f7a7646085b2dae06d7f34

SHA1
0a5c6b091b8a1eb9de1f588d51458ebdb665c276

SHA256
ec405ee208923b822bc6b256e2507a16d3fea0ccac6e828f6d4d364231bab7b0

SHA512
c0d7a1b1c9764002d05992db0ef292030c4497707eb7e4a0871105d0d7b7757fce114a4a4d39672b8fe526838de572a8c9b5d1fe5408d4515f17140e25379784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a3fec02aa4de02a95e2a8a11ec49569

SHA1
dfac1dbd6d652bad6030b01f37615d7cb7163817

SHA256
a980ec59fde0398d2402555f7d7005678d2544e1dc83dd7aa0eda4e100749cf8

SHA512
04550613cac22dff077d1f47f58308f17a93e168a7c2695efcc8c2bc26ddef9af45c43d5c95afa11fce5635b47a14ae16a75fa08fb09e0529f67de6b468e251d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ddb3ef72a219e4ea5b3199b549885dd

SHA1
d8cee82192818679efeac94d58addba8c5ab6d10

SHA256
fe49255a8d1c2e70a3890db7789ba801cf6ca65458c9af8329ed80c8f1f15691

SHA512
e52e7a3eef3ee56c5216a9b29ebda93766296bf5b336bfc159dcc59fd5d7927e8ce9263216d4c1c75e77caf7954aea1f6491a472eed831ed03d327ecbb400fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
77722a8aae30533ca211083673de1bcb

SHA1
10922e914e4f4882c64e9f5731038ba8edb606f0

SHA256
a7d51a993e1519563c3fcc7e2129b181131873d6789afc8856df62acaacd43cf

SHA512
7dca886f9109b5899e0274e72b3d96cf44be253df40bd379223d0c862148f61fe1076b068c5d804868848e68ae36f96a83cf904044663b9950e3b3e94b8f8cbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
15cce0f6160a7791d5447a6eb2a5f063

SHA1
21e15fecba5d0ce1c69370830be79d69b0e680f0

SHA256
9d9dd9f08f317adaa60f365730528bc516deccd976c93181e0318e2bc262d742

SHA512
95e0fea34809da8413239a55cbeeae5efb128d4657f77beebc649993475c6e0b82551441f7a9b73d1532435985712dbf9189a99da0654dff4315a31bf1733420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58752b.TMP

Filesize
203B

MD5
11ecd0bff018819572e5b7bbd207d3c3

SHA1
ec76c072bc3f632cfe9956f68dceb83e73412fdf

SHA256
76ea8b1caf9cc0872fdbc65e716e0c21fed08e7c2de667170b22bcbcb68c3812

SHA512
b4bec24501ee44b185af4ca0181064e77a7dc149360a0b7e1ed5e159d8b45b75634bcdf2f68ec0f697e9e41a18a9a58ed65bd7bbdd1ac9e8086db663812687d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
808464f68d6653e5cede65f8a8b97ef9

SHA1
7579638bb877297d195ff293400668ba8766aab8

SHA256
8b238cb747bde1d0b573d355219142fc8477540bf219b73915d1a25f6093d92f

SHA512
9c3c3f1da437a523a1d244b3eaa68f08db0f005c6c99777910e4ea83052414941a57a87a34de6ceddbbce67ceb2bb4d5f28fcb731313e03ec0f86202d6fedc1d

Download Submit