de672a44b62f7f4862b94d14c74956cf91346312f8227d6a5aa1b0d509fa07c1

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PlutoReaper/PlutoReaperV2/PROGRAMS/PHISHING/facebook/mobile.html
Size

9KB
MD5

781baa7878daf277f0faba6353ed541e
SHA1

1aadcd6dcc52218b5652f7c91d9c4d741536307b
SHA256

2117e2514f1666864ca757e53dd379dc88eaf92255613057fa5f0668aca68379
SHA512

88c0efa80ebd0a9f91e5b245d6d55718a2f1bd27a645ed9a96b831f38e6eeb98c20a744c665342c4f47b40a8228cf41a33b0b2864d5c301345c1e4f8cbbcca49
SSDEEP

192:S/GYrJb8WGtE5f6eE7w5a91mFsOYoTKqob:S/GYrJb8WGtEET8a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
3728	msedge.exe
3728	msedge.exe
2988	identity_helper.exe
2988	identity_helper.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe
3728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 4008	3728	msedge.exe	88
PID 3728 wrote to memory of 4008	3728	msedge.exe	88
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4188	3728	msedge.exe	89
PID 3728 wrote to memory of 4784	3728	msedge.exe	90
PID 3728 wrote to memory of 4784	3728	msedge.exe	90
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91
PID 3728 wrote to memory of 544	3728	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\PlutoReaper\PlutoReaperV2\PROGRAMS\PHISHING\facebook\mobile.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff817e146f8,0x7ff817e14708,0x7ff817e14718
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9789673090054766269,14559227817860752155,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4acb846f-fbc8-4da8-b67d-5b8d5f841df8.tmp

Filesize
11KB

MD5
dfb444da65cfd283565c7ddc73d2eb77

SHA1
d7498f9d7cc0d55acf65fc45a4b91ecd96282f90

SHA256
b9000b138c3622d72fcbcf6f0dbf2526aeef06524ab2184245ff007619777484

SHA512
639cec5518cbada6f98dacf5b7bbda3dc2f61efb6d923eb43420778109151035aec0ffff91d04277748c23241820e07dce7a1b4130d06b00f126ef9520bf585b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6cdd2d2aae57f38e1f6033a490d08b79

SHA1
a54cb1af38c825e74602b18fb1280371c8865871

SHA256
56e7dc53fb8968feac9775fc4e2f5474bab2d10d5f1a5db8037435694062fbff

SHA512
6cf1ccd4bc6ef53d91c64f152e90f2756f34999a9b9036dc3c4423ec33e0dcee840e754d5efac6715411751facbe78acc6229a2c849877589755f7f578ef949a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2b08db3d95297f259f5aabbc4c36579

SHA1
f5160d14e7046d541aee0c51c310b671e199f634

SHA256
a43c97e4f52c27219be115d0d63f8ff38f98fc60f8aab81136e068ba82929869

SHA512
3256d03196afe4fbe81ae359526e686684f5ef8ef03ce500c64a3a8a79c72b779deff71cf64c0ece7d21737ffc67062ec8114c3de5cafd7e8313bb0d08684c75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
257B

MD5
8ad8ba69ac24514e6a212c8f1ecfe4a6

SHA1
4be62d82e96f503199f407f49230a3e3646c6c47

SHA256
4000b5ed04af82cf1e45534f815a867c45993ae9a92e3102688e511a1fd2a4a0

SHA512
f058d2e70802b1f37c3b937cd30d9dc1841ebefbb05a056a0f6827ccb0fc4f92d17e9cb44e70959aca5f6c0a078f5af4f2cc13329480aa7c3eddb45805e5e023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7cfc3c341f9f9249b89725c95250d41b

SHA1
f364624242627452c92dbdfa7f4cc44b14a1d88f

SHA256
112769ece9a6678a6e4b84e42110944a451895265dab284f827e8ed3dcbcc1d3

SHA512
8ed5f07175f0d8fb904084250ea8aee38400aaff5cb4e025c264e4a595a51bcf7f36880c6019cc5763e81e5f128392cb719d6f0f8c4d2af65f9ecb1f130a4208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cca7af9a37a8c40b49663f931e27d21

SHA1
3f94c50d68c50a34ff9e1c8152208bf6d576c95c

SHA256
8dfa16890a16dc5f7b15897bb545a127b670346da47264c3040187ec9f62c6ef

SHA512
697091ef76bf1e07cdd83eaf386cbced94901d3bf170f5ad38fc0238d5ca9109c9b07c109248fda639f8ef3a58492d1c2ca9ffe2f2a87a76fa59a3952ee96732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit