0fb0254c24e0e2ef2e3dcc0131b0476bc7e567d2b81788ba6a2e65f671b5e487

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2025 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_f8158c89a7eeda2f213098a32cee143c.html
Size

137KB
MD5

f8158c89a7eeda2f213098a32cee143c
SHA1

7010d8eb6f570f888d2777e3f63ae66c44f7ecc1
SHA256

0fb0254c24e0e2ef2e3dcc0131b0476bc7e567d2b81788ba6a2e65f671b5e487
SHA512

d8647362a5c0fb1378b815ad2053ee2efc42892adf8c16f2b726fc27fb8c54027b43ddf56460b00d220572d1ea6b1f1a3eacf783351a9db71acbcee2777d6907
SSDEEP

768:2fk1ATx+Bw24Tp7VD6/ybiXhW8VI0Hoy57EUJ3uCmWDrODQPydd7rxq0pa7XE6cv:2hHD6aD8Vvo1UJdcFpa7XHcDOatoCl

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
163	4836	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2452	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
1264	msedge.exe
1264	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2576	1264	msedge.exe	88
PID 1264 wrote to memory of 2576	1264	msedge.exe	88
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 1788	1264	msedge.exe	89
PID 1264 wrote to memory of 2228	1264	msedge.exe	90
PID 1264 wrote to memory of 2228	1264	msedge.exe	90
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91
PID 1264 wrote to memory of 3584	1264	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f8158c89a7eeda2f213098a32cee143c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8406346f8,0x7ff840634708,0x7ff840634718
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4132598584729510843,15610182575260371714,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODUwRDA2QkMtN0M3QS00NjZELUIzNTgtNTkxRUM5NDQzM0E1fSIgdXNlcmlkPSJ7MkFDMzRCNzAtRjRDQy00ODExLUJFMEEtNjVCRDREQ0U5NkI4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzJBM0FBMUYtODQzQy00N0YzLUI3NjktQjM4NDk0NEVEMTYxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDIxNDc2NzQzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26562637-e369-4079-822d-c075fd82383b.tmp

Filesize
11KB

MD5
c6dbd3d3a39f06be5f7e13a8c6caa7e1

SHA1
9ae722ba6798b27214b2e847525bc827466786b0

SHA256
44e30a10803ded7faaa2a561072950c9c57bcaa7ea3ab83b76e8b1c3cd1188a9

SHA512
7e0364d3ae09fa417ff100a4797d5595a9568e2af94ff6ba4b853ad7a12e6b6bd62a5ce85ab03a33f2529fe630fc94f3194f088a51a707c321790887657f5a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb0cb9bc9bc47b241cea8a15930aaf18

SHA1
bea4efbadb649764c8c0dde5ffb550e2a5f91a26

SHA256
7ba3da7afec53ca47958b26551707592ea453b1af13688f37fe0e1ef411a8b8a

SHA512
9eccc1a158c23dc034e4676ee071414bf9c67912b5e2ab6181d325167ce008e13c916967be62c845d4c7f637c03cca9676af0c41ec5e946925050090d0b49e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d44f6d6e7efe70fab6c852bb5b7455a0

SHA1
0e10115d677f55f7cb4b5721e1275df5c01ea842

SHA256
aa26ea90b867a3f439ee88c55f31b5a7890b3503ab814fea2d27f0149c9aafc4

SHA512
ee5f719de53d37e809361d56039002e974f0cf1561079ada1f5cd2ea2db310cb80226ba8b9bca687c2ddf9696b71abcfffd8d5dba4a07198e1e4d3b4e2e0c3e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
bd265cdbc2c41c6672650a80783d9865

SHA1
12ced6789f5e65ab97106b2e9a8562a8129dd4b3

SHA256
150a92f150c54c395ab60104eee17cae264fcabbff7f746cf528150dba00d587

SHA512
286f4da162d63d495faf0d1bd6a613af4a6e50574fb76fe38b5d30362e09d86a9dbbbda9a8413024781a77b4fa15e27f514e5721e76be5fe883538f6b983ca2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e97deecf8bb8992eb3f85c3b5b1518e2

SHA1
b97ed1c6feaf40ea0bc7c89f35f26d4bf360359a

SHA256
c6100a00cd6a66611d93664167bf64290a6ba7d5e2a134823eacb095bc2e2383

SHA512
608ebe153f3a06918d5f69626ab55e2df44c34ec324f57dd9262b0c0599651b428695ecf90e892a738e91968a0840294c076975a99570f9732dedafe66147c30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c449139bb7211e7765db457854033720

SHA1
b27094eed9f454fbf6d020637faa1cf92520fafc

SHA256
4723a219bf2b9040206b43a6fc4ca3902e14737df4427b53a02a05c7ff55a3e6

SHA512
bd32802ac2aec2af477d70eaf9782668785d893f9248f2622ab668b111c0c86489c6bb99b467fe819e18b48f38e4842358e363bc59c15b0b090e11f3ef9f79ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
630bda138450feeb60fafdde2117cab6

SHA1
0cc5bf250735df1f72171c43996bb415ee1ebc0c

SHA256
eaed2c1e1785d37c181ac20952018438e435e1564cacdc834dbc7760cd021c70

SHA512
efdd8420c3221e00bbe6b17576bac69aafc3f8df9d772b41a23ffd6579e39cfc637080482a23e524927a4574b577e4918fca20f1320be6c196a8fe5168eb46bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d96d17ec5f0192498746b3eec4b5e4c6

SHA1
0c3b46964a96959aafeeac6b57a4dd003e16f4fb

SHA256
418854709ecb72132971e4acfa3364529e411c75d4248291d176a52788ebad88

SHA512
a0fbded6ad6eaa605ddcfba25639c8e65652e3e864e8cb8e169a5593e50dbd33b723b78e0745bfe61467d73a0f6b8f532ce02a88e8c11a560a2be35e4b670d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e860cf1fb3396605bf23cffb2fed66d9

SHA1
883027556480115a623af50b9be52f7d08e0176a

SHA256
ac14f22c0bb983091d99d98729a5105cbc0dcf0c81b9e9d51b8033b903a412bf

SHA512
c7449af32d4b094bbbe29bf4b25ceab4fa761562e2955e36f6b724d1777548fb0571b91f55f89706fd72f646248d69ec0e8b9d2c54ef209ecc886f5d61f1408b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bfd2c82d0344f0de63b1d2eba4e509a

SHA1
6e937f8a00af7b4c89661878ef92e43240866a79

SHA256
b9d6f6ea1660b3c6d2e3761491192b9ea649e0be27d416cd27ebd3ea6a2e9ef7

SHA512
9bcb21c844eb31dff6ae509c952505baa935dd1da816cc7d813a07b208a50a538d7d309cdfc27bc1532c14d4b970123ed113ffc72a458f36dc8fa9d0a9bb57ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
2d8dcb36833d5e549483ba7000a5067a

SHA1
be6ff7c4cecd590fbb182224f3d32b0034356b61

SHA256
bf4ec287da10ef78bf4da9dbd624568762fc269d9289dcea77fae9e715099570

SHA512
472ba34b8398ee3b9d2acecbd588c0a2f8f1123e462dedcf94b37b73ea13ba5e44eef58bc18717f60dc5af04bf5e7965c69313b439e50c539f55494919310271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c37a.TMP

Filesize
537B

MD5
e57e9d37502223016eb39824308c35dd

SHA1
91f39c13aec23631dc1c27ae570a34a16eef4cba

SHA256
9f1785868701b05a8d0b8f7beed242328b7aa00f336bd038915693a1a797fa0d

SHA512
c21a75adc627186582b40c5a01444adb7a761cb388ff1fa6973d7b7eeb0e28ccca68ca40b2a28b517ae1b37cf7c67d250af530bdeea853716077bd83284a5615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit