2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

Resubmissions

06-01-2025 20:05

250106-ytzahswnax 7

06-01-2025 20:03

250106-ys6cfaykcj 7

06-01-2025 19:56

250106-ynwmfawle1 8

Analysis

max time kernel
117s
max time network
120s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
06-01-2025 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMouseButtonControlSetup.2.20.5.exe
Size

2.9MB
MD5

2e9725bc1d71ad1b8006dfc5a2510f88
SHA1

6e1f7d12881696944bf5e030a7d131b969de0c6c
SHA256

2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818
SHA512

62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39
SSDEEP

49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Loads dropped DLL 4 IoCs

pid	Process
5012	XMouseButtonControlSetup.2.20.5.exe
5012	XMouseButtonControlSetup.2.20.5.exe
5012	XMouseButtonControlSetup.2.20.5.exe
5012	XMouseButtonControlSetup.2.20.5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XMouseButtonControlSetup.2.20.5.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Bootstrapper.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
2736	msedge.exe
2736	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
4720	msedge.exe
4720	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 3428	2736	msedge.exe	80
PID 2736 wrote to memory of 3428	2736	msedge.exe	80
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 1232	2736	msedge.exe	81
PID 2736 wrote to memory of 4792	2736	msedge.exe	82
PID 2736 wrote to memory of 4792	2736	msedge.exe	82
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83
PID 2736 wrote to memory of 2624	2736	msedge.exe	83

C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe
"C:\Users\Admin\AppData\Local\Temp\XMouseButtonControlSetup.2.20.5.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7ff852203cb8,0x7ff852203cc8,0x7ff852203cd8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14235614401553673289,6645499190485661536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000046C 0x000000000000047C
1⤵
PID:2908

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3888f20e8fd7887711ddca46c0560858

SHA1
6589a51cb9ffc50c1570352bc041b478d334091f

SHA256
cfb1505abbfba100f754c676e1db6d9c6d03db86fece12eb2534d0086d2a3b5b

SHA512
7b55f04965b15a46dc85696c5c00a7bd3b3c5e18cd5c2cfd8e5d274c4d75ffe0a53ef084469c8e32d86947efcf750a0160b73dbf307827aa2a563a7246ace011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
40ca07b448cb0c524bdba86bca1ed882

SHA1
4c72090754b280138b5ebe596dfb3f998ef69f53

SHA256
227160c2499125855d7a375d73314445b2898412dd6e323b49125389c951af7a

SHA512
cef5f0995c04725751ade565651c9efc495bbb9153df3d3ef2668fed72bf193ab18faebd6bb36447b22a90120afc6b0e00f017e332c1cab6b50cbe27b1f92da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6db5410408def738a3ef55ba2e6202c8

SHA1
75da635d998f7bb57609eaec09f86f74809f211a

SHA256
6c41b70d0cefdc03f01eb615568d1c383b27bed70756fba74ed4da08f63f5216

SHA512
45402465e72b1eb0cb8d47a15e8435400c024170c0359ef0ddbb2139f89fb042df855821a4f6cb8dae247f1e6981bdb75d29f55f97447cb7ca24fa9ba0c70c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb3e82f379b2a7d14954068050d91adf

SHA1
ce72b3d6687050131b01c51422a734e1354f9fd5

SHA256
e0976c8482d80f2dbb54e4dba4023c1db6a5b7d8d998c0c9f5ef7332a161b63d

SHA512
28ed831a38243e88de5c32d0835ae02e83c59b70a34df4587d0e467f8844a3ee4d0913aa703793acd33cc7d852ad9a9d8ef26808f8da309a2bdc491bd3852bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8d3c1d9a3c1e1f57e7824f443a2aa7e

SHA1
04f40c9e854d5c11b02b8e7ee23132c5de15c5f4

SHA256
067ccdef1e7f6d655ae699d80b000b2d4f6be985bf0c81a56d07afc1d4510109

SHA512
edf1a1e88d999d497961a939401b44b8a3cddccc68fe86870ba5e090a982843bcff20be734058db0c7da6211a9d7b85f34e6fa9474c85465e4dcb3dfc815004f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f729aee9a20cd34ce5173a74afccf084

SHA1
707ed134002b66805ba44fca7aea8686eee3a72b

SHA256
242ec34c5f7c8ebf11aa3ed72bb89892b7399f344d80c542960120c5a5e04b63

SHA512
ca51a0076ade435ab64370cd45813493243b8d76c58a7874a273ef87a0111797056b1bc472ff3677c429147bbf4b7b3f71ad43688b4eabc72a950ec16fb7e248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
867B

MD5
02773f5459b7495d4a33bbaaff26aa3f

SHA1
5ed0d2177a907768eba99b867c9c6e2c6488ae48

SHA256
4ec7c69f61c3bfc2d10c9322f1c3d929dce7587b62da7b425de3c5043162292f

SHA512
63b30093810916100268c7a9d4c25b9fc452e3a01aa47c9f393c65a30d6383673a8581bb96ec778579fa1e8549a4a1ecb81c676fe6d560531a2f8e858b47e753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585138.TMP

Filesize
867B

MD5
944f2a5a47673c6e6741b0d004ab8c85

SHA1
f9d543bb8cbced1ac1f0915874c1cbc455fc3572

SHA256
0276dffda8e8e499e555adb37c7afbdbab36f38ddbde343ef89e8bcd51c67dc0

SHA512
3412c882ae0ed2f8cdb19c21e1fe2a9adb899c6eac41983d80348ac6524b390e9d1ffce90891fdddb427f3af8e84437288251817a73b8dffadf76cd8f086e121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a48626cc418bc1ad0fd847831ff68b0b

SHA1
c6e45619f7943c6f68df4c38517f6de6731695b6

SHA256
172a1c9bae49d4af66f4aa475bc3d860882cb1fabc462069251747caf8cde3cb

SHA512
202387a7cdbf110e22b91557e897b77c3c5397e1f6f2fbefa2337592719b5c74ae4b7a906343cdca5205b0f1c305b7956361fcf72ce781f1e41dfc4dca1d7a9b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
ef4d9165f280b4d556f349f896b81ce9

SHA1
ddfe1709a292d9900687d4fe0b4c8b2429d848a3

SHA256
8add12630f4210146f1c0f543e34f61810eadbb6759b6eb3a6303337155c9cb2

SHA512
e8b2c08605f8c3c9eaf0a8f905e65829ea2ff4e0d45c79f171ff685e80fc74e4f7858b4975fac8ebfd4dc3b21a14fe571e446889d4022400e84d8193053152ac

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
71a6b59e08e25451e52675c842fae23c

SHA1
565a97673954a9209c7a05fba20b89d10b88025f

SHA256
5b96212d3d1347b76c8c1c64b2f7ef981242bedd3b84b766b543d56dbbf8dbd6

SHA512
5cc98eb2aa02e2e69165170451d89dd880893e6b07440bb84fbab6cf92cb558bd58c2235d8d64ff43d380c5e9869827800d310ee67950bb21b498d89fbb5aab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB817.tmp\InstallOptions.dll

Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB817.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspB817.tmp\ioSpecial.ini

Filesize
726B

MD5
27005a9981e94e92b81bbf46169c55a7

SHA1
342adc33673f8e1ca75cfa0251b07afe3960b200

SHA256
4517a1897f2a33f5fc47713816f180bf614e8cba8ed37f4058b318262ad5f909

SHA512
0907f5e15069667b12f83bb885d473543721b45ab6a061fe586344d7e29dca454cee1da0a1e8979b40993d3751a634c6c48b319948a6de42862c46e2b007ed38

Download Submit
C:\Users\Admin\Downloads\Bootstrapper.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit