cycbot | 4d742321425e275185847a05e052e7a163615d2b2d25eaf5e418133a6c4fe715

Resubmissions

19-12-2024 03:36

241219-d5y4nsxjal 10

19-12-2024 03:18

241219-dtp2mavpax 10

Analysis

max time kernel
149s
max time network
113s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-12-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe
Size

184KB
MD5

fe394925e5b4175238a536bc3a4ba7c1
SHA1

e3fb230fc1e5ba65ac4b2fc7b238b2dd7af17929
SHA256

4d742321425e275185847a05e052e7a163615d2b2d25eaf5e418133a6c4fe715
SHA512

8cd5f4fcadd85a1ee7e0d56a57cc321f6290302a508319f20afd1351b445eceb52db2a5118827640c9a9f7ca3fb7718d26e966140ec608688b201de919684bd9
SSDEEP

3072:RgNUlyQrT2GI2o0tUvJKj4QajGarN6ggjZ5LAqRWBxz0W3IYsxFs:2sCGNzmvk4nHrNngjZ5Re3IvxFs

Score

10^/10

cycbot backdoor discovery rat upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 7 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/3424-13-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/4296-14-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/4296-15-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/1880-76-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/4296-358-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/4296-376-0x0000000000400000-0x0000000000455000-memory.dmp	family_cycbot
behavioral1/memory/4296-378-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4296-2-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/3424-12-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/3424-13-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/4296-14-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/4296-15-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/1880-76-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/4296-358-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/4296-376-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/4296-378-0x0000000000400000-0x0000000000452000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\Registry\User\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2472	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4560	vlc.exe
2528	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
772	msedge.exe
772	msedge.exe
3244	msedge.exe
3244	msedge.exe
1764	identity_helper.exe
1764	identity_helper.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4560	vlc.exe
2528	explorer.exe
3604	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1992	control.exe
Token: SeCreatePagefilePrivilege	1992	control.exe
Token: SeDebugPrivilege	3604	taskmgr.exe
Token: SeSystemProfilePrivilege	3604	taskmgr.exe
Token: SeCreateGlobalPrivilege	3604	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
2528	explorer.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
4560	vlc.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe
3604	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3424	4296	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe	78
PID 4296 wrote to memory of 3424	4296	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe	78
PID 4296 wrote to memory of 3424	4296	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe	78
PID 4296 wrote to memory of 1880	4296	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe	79
PID 4296 wrote to memory of 1880	4296	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe	79
PID 4296 wrote to memory of 1880	4296	fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe	79
PID 772 wrote to memory of 404	772	msedge.exe	86
PID 772 wrote to memory of 404	772	msedge.exe	86
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 3672	772	msedge.exe	87
PID 772 wrote to memory of 4888	772	msedge.exe	88
PID 772 wrote to memory of 4888	772	msedge.exe	88
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89
PID 772 wrote to memory of 4376	772	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Local\Temp\fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe startC:\Program Files (x86)\LP\4FAD\F09.exe%C:\Program Files (x86)\LP\4FAD
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3424
- C:\Users\Admin\AppData\Local\Temp\fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\fe394925e5b4175238a536bc3a4ba7c1_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\D351F\4264F.exe%C:\Users\Admin\AppData\Roaming\D351F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\StopTrace.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2472

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ReadInstall.3gp2"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd8e823cb8,0x7ffd8e823cc8,0x7ffd8e823cd8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,3400127073801596152,11756379131260906002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2528
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3604

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1248

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2694519cfde9b5bd5f25e8e2d083a6a

SHA1
f27a93e94b4e89ae7ff8d3c314d02b69cef32334

SHA256
0cd9b22111c17756582ee3bede3e1d235d320161fb85b66a636102de68d28dec

SHA512
bbcea94986280e94a49c21fb74ed60b541170542edbcca606fbd2e5769a96e08164c44db284a2871482ef3daa46d0e5dfe1c4a81319c1340e0c623f24e4d59bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a0ba0fa40b4388632f1f59420d436418

SHA1
2da69d321897b83e752c1b8a7f51f55d6757bef0

SHA256
b8ed45ee034acec69265e2db4a80b60bd5dbdb3872c16180beb401c8609d107d

SHA512
512edef4d4fa1f99ae3dbd0258d725221efc5564b02cf78b1991d7ec74d47916c019a5c06e7a5cc7fb5f07d43a79c9ab7825d5b3ba1cbc74d624d2f42ed1b236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd989228e57c305d00a4d6270e0aebe4

SHA1
25d4f01969302ae48d5077c46dbd24f20e1a0e82

SHA256
80192e33450eeef3dc23dfec97b3c112ff2dd9382c4de84f33e724dcca06660c

SHA512
cc22bd613f9b85d05ecc167d8141452ac7e1d03aef47b2c32a6aa1dac0f6af24842fe070a581f135ab2a506517e034eb3d3593fc4e49cf08844c4251b58235ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
9122cec62041e55cd39483f4469cd611

SHA1
31d5db8739725c209ae8e5946cb32c4e07c270e0

SHA256
00a8c69a3be344a84fda22e7bcb39fd71aed65fd71b75a0de4410159c2e39b19

SHA512
0bebc3499f0e58f0bc3a84600b460ada3c30baae51db13a91c9db1f13336e710f8351eecf6849da1ff1255c4452b50e9ccddab2c0c22e6c207b83e4b9af8969b

Download Submit
C:\Users\Admin\AppData\Roaming\D351F\F6D9.351

Filesize
1KB

MD5
e900b36bedcb4efd7857e909bfd3911d

SHA1
0311f904d76ed43d0f31b0f65c8681d78baa79eb

SHA256
013f09a6c0cc26dac7a07e8525cf4fc29d0a29ffc5b727e7c722134c9233c250

SHA512
c127d914b59cf1288f284342450c2475fba8ecc145754159bbe2dcbec1359e737ed66cf90d1bfd90942e96f8db9fa7f1f422227963438ce7388d0c75a03bdc50

Download Submit
C:\Users\Admin\AppData\Roaming\D351F\F6D9.351

Filesize
600B

MD5
4850210b215ac80d19a212b0510e1049

SHA1
17bbe0c7a0758a50d325798d33350347dc94368b

SHA256
551a85b648051992edcdac884de8235cbb12f5538aff0dbfeba767e0a37cfb93

SHA512
3b7adbfbc370500b0f2e7b0c77df3428e99395a3443a9b128b8af1ae6a2a99c285b2fcaed78a3d7056e9757ed3cb73779e80c88ae3c1d558afba6246995711b6

Download Submit
C:\Users\Admin\AppData\Roaming\D351F\F6D9.351

Filesize
996B

MD5
af1ab25aff8ed4f2310f911da4bf1682

SHA1
00e7f95d949d62f07229ce81ccc8c75e5a91ebbe

SHA256
6e391afd26ac1772e8b51151d4652cac3effa79a6ab58716a4bc193a0749f80d

SHA512
e40936c284f0907c6aec7a579a0ea62527c83272f23e5fe422624d4204c048a9c2fe084bc7c9c4b47cfbb80bf8707e8e82a3e7bf1e2cb9d3b9ff831915b0fbf4

Download Submit
memory/1880-76-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3424-13-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3424-12-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3424-11-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3604-370-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-372-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-369-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-367-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-363-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-362-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-361-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-371-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-373-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/3604-368-0x000002242FF60000-0x000002242FF61000-memory.dmp

Filesize
4KB

Download
memory/4296-378-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4296-15-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4296-14-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4296-376-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4296-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4296-358-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4296-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4560-163-0x00007FFD8ED80000-0x00007FFD8ED91000-memory.dmp

Filesize
68KB

Download
memory/4560-168-0x00007FFD8E7F0000-0x00007FFD8E808000-memory.dmp

Filesize
96KB

Download
memory/4560-167-0x00007FFD8E810000-0x00007FFD8E831000-memory.dmp

Filesize
132KB

Download
memory/4560-166-0x00007FFD8ED30000-0x00007FFD8ED71000-memory.dmp

Filesize
260KB

Download
memory/4560-191-0x00007FF7037F0000-0x00007FF7038E8000-memory.dmp

Filesize
992KB

Download
memory/4560-193-0x00007FFD8E3C0000-0x00007FFD8E676000-memory.dmp

Filesize
2.7MB

Download
memory/4560-192-0x00007FFD9E3A0000-0x00007FFD9E3D4000-memory.dmp

Filesize
208KB

Download
memory/4560-194-0x00000261B23A0000-0x00000261B3450000-memory.dmp

Filesize
16.7MB

Download
memory/4560-169-0x00007FFD8E7D0000-0x00007FFD8E7E1000-memory.dmp

Filesize
68KB

Download
memory/4560-170-0x00007FFD8E7B0000-0x00007FFD8E7C1000-memory.dmp

Filesize
68KB

Download
memory/4560-171-0x00007FFD8E790000-0x00007FFD8E7A1000-memory.dmp

Filesize
68KB

Download
memory/4560-172-0x00007FFD8E770000-0x00007FFD8E78B000-memory.dmp

Filesize
108KB

Download
memory/4560-174-0x00007FFD8E730000-0x00007FFD8E748000-memory.dmp

Filesize
96KB

Download
memory/4560-165-0x00000261B23A0000-0x00000261B3450000-memory.dmp

Filesize
16.7MB

Download
memory/4560-175-0x00007FFD8E700000-0x00007FFD8E730000-memory.dmp

Filesize
192KB

Download
memory/4560-177-0x00007FFD8D740000-0x00007FFD8D7BC000-memory.dmp

Filesize
496KB

Download
memory/4560-178-0x00007FFD8D720000-0x00007FFD8D731000-memory.dmp

Filesize
68KB

Download
memory/4560-179-0x00007FFD8D6C0000-0x00007FFD8D717000-memory.dmp

Filesize
348KB

Download
memory/4560-180-0x00007FFD8D110000-0x00007FFD8D1A8000-memory.dmp

Filesize
608KB

Download
memory/4560-176-0x00007FFD8E690000-0x00007FFD8E6F7000-memory.dmp

Filesize
412KB

Download
memory/4560-173-0x00007FFD8E750000-0x00007FFD8E761000-memory.dmp

Filesize
68KB

Download
memory/4560-158-0x00007FFD9F250000-0x00007FFD9F267000-memory.dmp

Filesize
92KB

Download
memory/4560-159-0x00007FFD9F170000-0x00007FFD9F181000-memory.dmp

Filesize
68KB

Download
memory/4560-160-0x00007FFD9F110000-0x00007FFD9F127000-memory.dmp

Filesize
92KB

Download
memory/4560-161-0x00007FFD94980000-0x00007FFD94991000-memory.dmp

Filesize
68KB

Download
memory/4560-162-0x00007FFD8EDA0000-0x00007FFD8EDBD000-memory.dmp

Filesize
116KB

Download
memory/4560-164-0x00007FFD8D7C0000-0x00007FFD8D9CB000-memory.dmp

Filesize
2.0MB

Download
memory/4560-156-0x00007FFD8E3C0000-0x00007FFD8E676000-memory.dmp

Filesize
2.7MB

Download
memory/4560-157-0x00007FFDA5600000-0x00007FFDA5618000-memory.dmp

Filesize
96KB

Download
memory/4560-155-0x00007FFD9E3A0000-0x00007FFD9E3D4000-memory.dmp

Filesize
208KB

Download
memory/4560-154-0x00007FF7037F0000-0x00007FF7038E8000-memory.dmp

Filesize
992KB

Download