snakekeylogger | 4f1ba7440d20500ac5a379c9eca60991ae571b460fc01f1146c75b5e2a005d30

Analysis

max time kernel
141s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2025 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Week3.exe
Size

812KB
MD5

5302477a2c210083be8d25280a1d27cf
SHA1

7d9cfcfe09c52303e9ab741353c06e014364cdd6
SHA256

c40b21462fa3c5ebbed41befc33078f7453e4ed5e2594a815103c1efe70d6327
SHA512

85be08716fbe5b9503dd1ce6ab42796c14ddc3bf60b4f5e71f68e66cdc72bbd47e32181ceb029f9cc0e3d8cee77ab4b29ed3305546fde326f4a3763ada223046
SSDEEP

12288:zWmfDfxt7J0iJKfJDbV5wPw2a7iLv1/L5le289QgM:v2RfJW1Ciblvng

Score

10^/10

snakekeylogger collection credential_access discovery keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.stilltech.ro
Port:
587
Username:
[email protected]
Password:
eurobit555ro
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2844-14-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3252 set thread context of 2844	3252	Week3.exe	93

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Week3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2844	RegSvcs.exe
2872	msedge.exe
2872	msedge.exe
892	msedge.exe
892	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	RegSvcs.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe
892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 3252 wrote to memory of 2844	3252	Week3.exe	93
PID 892 wrote to memory of 4684	892	msedge.exe	96
PID 892 wrote to memory of 4684	892	msedge.exe	96
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2016	892	msedge.exe	97
PID 892 wrote to memory of 2872	892	msedge.exe	98
PID 892 wrote to memory of 2872	892	msedge.exe	98
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99
PID 892 wrote to memory of 780	892	msedge.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Week3.exe
"C:\Users\Admin\AppData\Local\Temp\Week3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa4ffd46f8,0x7ffa4ffd4708,0x7ffa4ffd4718
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,6331875302262654330,11330589886665836225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2a8f2ebc841509f7b978edf590d3cd

SHA1
91358152e27c0165334913228005540756c35bd3

SHA256
631550765e3db02be0709748c0634a2cfdab711cea94f5890854d0c1dfbcb214

SHA512
e52180dd175f1e6ff72d76400085869387cd70da33919de219a04dc26871e8421e93b22e7c59125c19c6ee54a8a8f742d796ac68ea9077c9dab5f03b80967d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9bfb45e464f029b27cd825568bc06765

SHA1
a4962b4fd45004732f071e16977522709ab0ce60

SHA256
ceb8f1b0aaa1ba575c3704e73fd77edf932d68c8be902b33f1ba3b1d130cd139

SHA512
f87cce8bb5489b56027f5a285b948b639a1c7b0f213a111f057235177e5bffc537627c82586736704e398a0185cf2ad8ba8cdee788531fb753a2d08f16e906c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5b17b22b8e57a4ed12bbf983d4f6501

SHA1
dbfbd4a10ef28b70cfc3a327222fbd56df89d5a6

SHA256
f55c8ff48a7b8275803deaf1161c8df3c4d0b5d06e8c8cd6de5a82e3a4c11f4e

SHA512
5839591f3a9072c3b1878dec2c0c6004546b350fd4cedfc084d3d3e71838e70bc45903807749a214c2bd14c44870bb015848a55a7974a3addc0aa664faea2177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81f35d68c5adb49560c6d961db1f5294

SHA1
4f0178c38c26221b2f438deb691b956d2f443faf

SHA256
5a15ec33a534dee4d837b3c5a519e03c5757b3276391eb1b78345cae3f3749f7

SHA512
702bf3139bf3e0694f3f39be84a11e9ebde7c915a5246dac28d14ffeef9d113fb9b474639ffe474071a600bce05957d49304d91dcdea4c9d4e896af503c4658b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8c2b1b326e87755d018976abe6c9d4aa

SHA1
d38a1e5e954c00b889bdf88cf5b2d060980d50b1

SHA256
50908ff3bf77619be6c93b1fa9df30e0c1fa235872d9f3686c36fd96fe8020f7

SHA512
705d3adf7d32c0aacedccc0573aaa3817afd8fba5de0a0bcb9ccc1d93a5520676bc1dcf10cb571da03c537032f0ca566f1ef7a15a0f76b6e9dee867549f0d35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e37f28c04cabc2baa6befc81318a3869

SHA1
5457c6d4bdafe76d17a1352cb0286ad688ef91c0

SHA256
3558286ece019dbd593257377162d62945d8ac0babc00c799d744a790795079b

SHA512
58f37d8f5eb56e072472e91933d53551db37e6a54c974c5c228c29ba11a8cf77d05db12ce7d0cdcfad423f66ce60c032b428ba8006af4654fc4d2f8056741262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59d661.TMP

Filesize
872B

MD5
12a59fe6eade024b1365b1cd89994db3

SHA1
4c918deb007c3ed635f0e1024e8eb6065e90b3e5

SHA256
d8f5e16ad1be93a8fc9f00ed9db1f83ec09f633fb1f751604abf1f6bf5ac789b

SHA512
dc4cf1abd3f9db570e01b3fde0c568306091112e732d3a3cf5eb543f95c3f7cea938530eb6638104b2e89a0698daea1106117a4e99854c213f122cf998365ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
081594fe9fe5087324bb89dc8cf42a95

SHA1
898592214a2f0521fa79e7ed437df53615159d5f

SHA256
e4a79a0254d8a35347a12cb7157f9453b563cfc618fb79e42fe635594a05e6fb

SHA512
67b9d5e415688caff7432342a8a3d27d5737c38c6039f68472589bf099e8d7495f5ad0b20b372a79ecaeed1303554727e93968ae51d221b1a503190653890474

Download Submit
memory/2844-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2844-18-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/2844-20-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/2844-19-0x00000000060B0000-0x0000000006272000-memory.dmp

Filesize
1.8MB

Download
memory/2844-16-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/3252-11-0x0000000007F20000-0x0000000007F86000-memory.dmp

Filesize
408KB

Download
memory/3252-8-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Filesize
4KB

Download
memory/3252-0-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Filesize
4KB

Download
memory/3252-13-0x0000000007ED0000-0x0000000007EF6000-memory.dmp

Filesize
152KB

Download
memory/3252-12-0x0000000007EC0000-0x0000000007EC6000-memory.dmp

Filesize
24KB

Download
memory/3252-10-0x0000000007CB0000-0x0000000007D1A000-memory.dmp

Filesize
424KB

Download
memory/3252-9-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/3252-17-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/3252-7-0x0000000007D50000-0x0000000007DEC000-memory.dmp

Filesize
624KB

Download
memory/3252-6-0x0000000005260000-0x000000000526E000-memory.dmp

Filesize
56KB

Download
memory/3252-5-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/3252-4-0x0000000004FD0000-0x0000000004FDA000-memory.dmp

Filesize
40KB

Download
memory/3252-3-0x0000000004FF0000-0x0000000005082000-memory.dmp

Filesize
584KB

Download
memory/3252-2-0x0000000005500000-0x0000000005AA4000-memory.dmp

Filesize
5.6MB

Download
memory/3252-1-0x0000000000510000-0x00000000005E0000-memory.dmp

Filesize
832KB

Download