de672a44b62f7f4862b94d14c74956cf91346312f8227d6a5aa1b0d509fa07c1

Analysis

max time kernel
145s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/badoo/login.html
Size

211KB
MD5

7e38a80c9b9f7f806b070b3e82652163
SHA1

24fda725c2c48dd3973c6d55be84d219fc7c625b
SHA256

df4d5eec529e8d3738403fcf6654431241a2614724a7de37f7a24a22495893ae
SHA512

78cd39c18c621412356f96e06d2b1cffcf4783bbf45d8064547325096a6849566dca8e8ae1e2a1ce95d6dae5341a2fcb7d6120744e0a986470b943fa13ebae2c
SSDEEP

1536:CqKS/fJKQCoTKODBjlIG+AfupcG08iRYVXf1q5RnpEnXdtxB7sHi/vCh6TVCYjS6:J3XuPiRcf2nunXdpsHi/qw9jaqPfw2R

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
4712	msedge.exe
4712	msedge.exe
2972	identity_helper.exe
2972	identity_helper.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4788	4712	msedge.exe	86
PID 4712 wrote to memory of 4788	4712	msedge.exe	86
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 1524	4712	msedge.exe	87
PID 4712 wrote to memory of 3500	4712	msedge.exe	88
PID 4712 wrote to memory of 3500	4712	msedge.exe	88
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89
PID 4712 wrote to memory of 3124	4712	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\PlutoReaper\PlutoReaperV2\PROGRAMS\PHISHING\badoo\login.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee8c246f8,0x7ffee8c24708,0x7ffee8c24718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9871728561056455146,3129384254113576329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56361f50f0ee63ef0ea7c91d0c8b847a

SHA1
35227c31259df7a652efb6486b2251c4ee4b43fc

SHA256
7660beecfee70d695225795558f521c3fb2b01571c224b373d202760b02055c0

SHA512
94582035220d2a78dfea9dd3377bec3f4a1a1c82255b3b74f4e313f56eb2f7b089e36af9fceea9aa83b7c81432622c3c7f900008a1bdb6b1cd12c4073ae4b8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0621e31d12b6e16ab28de3e74462a4ce

SHA1
0af6f056aff6edbbc961676656d8045cbe1be12b

SHA256
1fd3365fdb49f26471ce9e348ce54c9bc7b66230118302b32074029d88fb6030

SHA512
bf0aa5b97023e19013d01abd3387d074cdd5b57f98ec4b0241058b39f9255a7bbab296dce8617f3368601a3d751a6a66dc207d8dd3fc1cba9cac5f98e3127f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
333B

MD5
c685b61e68acbb47b41d63189ce1b3e0

SHA1
528ec59d5b94fa63c7659e4f90d184de2943435d

SHA256
d15447b3b2fa88c904ce8a1834fc9e1627c6d6a99a7660c4c8c5d2bc4e7bb7ce

SHA512
21da5b49307807a487e78c168e03bd0196df9cf0d55377420830973e220e5276646bdb24dd7dcdc30ac2603de330d641239dfe1df0c681e6d79d10fc68cd0c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b15bb237e4f512ccb9c7ef05b942156c

SHA1
b90836b91b5714fd3749259c51d395baf77a4a90

SHA256
01a3dc28d7b5486359e9f5dff2aac3ee247d385be8ce8b236da0c7886ba342ba

SHA512
3cb48a253ea1f282ded63eeac066ec27aea1c3ff6da5e23e3fabbe32b614ee19d7d0c94a2a6bba14d0218d5ac16f0b2c651b376e97310d6eaf885de5048bc0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bec91ab33dd196896ef0463c5124efa

SHA1
40dc29cdeeb339b76d15ad8a04bbeb8c2113231d

SHA256
8f6bff549ca091944d12493f43499295d60dd4300a1928cc287bac5d0b00424d

SHA512
8e5f1f5e63ed0f69c19b5a418277f24e065a46cc0343e9776005ab37bf8fd89c9c10aec6e9bf5acee2e9187fe6bace0d3aa49a07116c39b38415ad1066ff1332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ac5add7248d3cff7402f0235bce6825e

SHA1
efd15468cfd67f79a760a077aaf5d32bcdb14422

SHA256
435cc5177769abda2ed0a8b8903843473eec632daaf0bcdec0ac598d0f310ad1

SHA512
8f2a762c6823562b773bef44eaac67d32483a2fc3795503dce6753d69b0602840f0fb5d196d64bee70b1892fc3d47988f2503d4d032c3f94880113f9b94c2828

Download Submit