ramnit | 6cfa79cd2b8cc9f976c612c75c8b1b5af2f379e72cbe4128b274738e6d625244

Resubmissions

25-01-2025 13:30

250125-qrr5esvkc1 10

25-01-2025 13:10

250125-qehefstpdv 10

Analysis

max time kernel
84s
max time network
85s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
25-01-2025 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2bf426318958fc998b4bffef442628ce.dll
Size

432KB
MD5

2bf426318958fc998b4bffef442628ce
SHA1

32930819231971ebfa3e7325725c081107c76240
SHA256

6cfa79cd2b8cc9f976c612c75c8b1b5af2f379e72cbe4128b274738e6d625244
SHA512

53451a27b4851cd9d633d71e8b7d2e08c6cf62150400ce135c395c40ab1d4e4b83f005394eaf00bb381c2bc6bbfa49a5691e2da3296d811501518c26516bb0c3
SSDEEP

12288:eXo450qjYthuCNIm/kqF6a2FjyHIDiNmcs:3/ku6FjyHeWt

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 1 IoCs

pid	Process
4572	rundll32Srv.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001c00000002aa53-2.dat	upx
behavioral1/memory/4572-5-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1980	2656	WerFault.exe	77
4012	4572	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32Srv.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
1692	msedge.exe
1692	msedge.exe
1144	identity_helper.exe
1144	identity_helper.exe
1400	msedge.exe
1400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2656	2100	rundll32.exe	77
PID 2100 wrote to memory of 2656	2100	rundll32.exe	77
PID 2100 wrote to memory of 2656	2100	rundll32.exe	77
PID 2656 wrote to memory of 4572	2656	rundll32.exe	78
PID 2656 wrote to memory of 4572	2656	rundll32.exe	78
PID 2656 wrote to memory of 4572	2656	rundll32.exe	78
PID 328 wrote to memory of 4188	328	msedge.exe	87
PID 328 wrote to memory of 4188	328	msedge.exe	87
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 3204	328	msedge.exe	88
PID 328 wrote to memory of 1692	328	msedge.exe	89
PID 328 wrote to memory of 1692	328	msedge.exe	89
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90
PID 328 wrote to memory of 1404	328	msedge.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bf426318958fc998b4bffef442628ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2bf426318958fc998b4bffef442628ce.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 320
      4⤵
      Program crash
      PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 616
    3⤵
    - Program crash
    PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2656 -ip 2656
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4572 -ip 4572
1⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe42763cb8,0x7ffe42763cc8,0x7ffe42763cd8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8181193295462901449,11050195040739515280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c9e1bd8-fdbe-4ba8-99aa-1329c648eb6a.tmp

Filesize
402B

MD5
60026d2750ff9ba67845f8b4d741b61f

SHA1
832c27be07515022bd6e5ce62255d605818f3cc3

SHA256
841d057056c244a0990008271830edc754e4f18231d12913b640bd32851b3507

SHA512
c6f539ac83f3f8aa919e38c2877ce5499d9c8fba3a3f135f951d04e197b4a2c86341ca4579a36e409d663dcb736ee92901d728d73b7e93d00841dc26e530b969

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6317e262ce407150909d90695de32544

SHA1
13a108f15651df3d80564b2cecc56958401bea79

SHA256
5c1138796ffe6b24724e255fd0862594eb5cf3ce359a3c2e6721d1befb9e6c6e

SHA512
9670e3a94ae6db66022dd479789b8d716109a0b4190c2849e2543efcc7dcf4cdf5b84c448b71af843c3d6ce81ade13b212d8a3450a23922c2216b1e5c1dcc6f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
753881d530ba6e6726798df567e042ad

SHA1
f1692461ddfe10b6908fde1933d1755378c6a41a

SHA256
8c2b7b14c25df768669992b78be21d604e3980f1e1c7b9cf26f2376a28bd783d

SHA512
a7903b33d8bb4e0db7b0a05608a5a659303d51e659e93198dc66c09a18a1795edd2a425a02272fcedb36852e6fd9f68b9e387720874004d3f2e2c4d4698c720b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e878f084017a12c17306af0dfacf510

SHA1
e4a9e2d83d51faa91bd57868f863fc53892533df

SHA256
be29e2d709f5ee79f8655972b6ebc1a7b7cebeb9ae72e11859105d6a7a448b36

SHA512
aea4942dc9b6570776e61780c46ccd016d3aec04e930e25ef465feeeafb4c90f9526acfe946bf9e874cd9bc3b9f302527ba83aefc53112db07a342c5c8b543f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13c307a2708a90da351390d4e95581d9

SHA1
7e476a1fb1d77faeb039a42e404e6ef482d46a40

SHA256
6eebd8c08df8831e22225289dbac4ba691c3ac8ab38bd86a82be84e160ca4781

SHA512
1ee6bc84bd80bb708572de7b1073ead40d7cb93de51ede52b936a7cf90319b5ed97d8d033b34da28f8de4984fc7e5b24bb9f057c9a2d643f8d6434f02f69d9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
e0976bf481a55878b93738e4b205011f

SHA1
e1064004a7a4eb779eb6eea3285bffbc99d31e70

SHA256
bfe1578086a032b3eacd6666d9510abcbb5f15a08793aabd7b46fd72a43dd3ec

SHA512
2423f9bc8764ea311911372d5e48a3f48f01153b2a14cc367e333c70244fd35ebecd7d3b357985ebf47101011ea03191f9d5c656ccb22c0d640f75d6ff7ab8f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58992e.TMP

Filesize
538B

MD5
07af9ba257e4370607864bfc64cb7ea2

SHA1
a0ab4e667b30ec96ddc73d082c2f4f346fc7a069

SHA256
c32d629946bc90d152cb959f80e2b69d73207cc3af10899c2927db7637363e52

SHA512
3e46bcf97d99d42404e4f7cc3bb230d94ee1ba03ca19a2039329599d02445de32dd52e2c0b2d7d18424c0e565927ea86b25b195f49a662b4035cd2c7508df2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c6d63977b5ae1f0ec1e79890ed06ed42

SHA1
c5c11bceee3865e750b2dfb4a424e80440a6486f

SHA256
7a19f5d11f5c277a2b408b890c23b68da29fa7e6e2c420bb4c37f9f950a8db29

SHA512
235295e3b23b64059b02801690ec722b479cd475f3125f0cd7a3966da8a24404581c56a2195d3d2ddf43a4e9ab6eb5647cd58327e6e66a5566dd1c654981d361

Download Submit
C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
memory/2656-7-0x0000000010000000-0x00000000126A4000-memory.dmp

Filesize
38.6MB

Download
memory/2656-3-0x0000000010000000-0x00000000126A4000-memory.dmp

Filesize
38.6MB

Download
memory/4572-4-0x0000000002000000-0x000000000200F000-memory.dmp

Filesize
60KB

Download
memory/4572-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download