d8bb97a2d453d659c9df7b10df2030f33dbc566da75184e312b148107ca906b0

Analysis

max time kernel
132s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250411-en
resource tags

arch:x64arch:x86image:win11-20250411-enlocale:en-usos:windows11-21h2-x64system
submitted
17/04/2025, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

alfa.exe
Size

137KB
MD5

510c893c3552e271cd3c407dae2c82b0
SHA1

5a30f8ec0137a4f26d160a7ff48f6ebe7dafc383
SHA256

d8bb97a2d453d659c9df7b10df2030f33dbc566da75184e312b148107ca906b0
SHA512

2598a9064d7b6866b82d5a7d433c8e3cea7ea03e340d5f8fe80a3878e68b6b2fb4bb6159f6ed80a5a148a40059f282f78586af4682a452f830c4b7755ddd2a30
SSDEEP

3072:aVvH8RuVrLyEj/S2CUGACcceJd/klDHa/R8mxu3s8QyPu:KH8RuRLlzgUd6a/AslyPu

Score

8^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3796	msedge.exe
4176	msedge.exe
5916	chrome.exe
3716	chrome.exe
2136	chrome.exe
5460	chrome.exe
5596	chrome.exe
4996	msedge.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	alfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	alfa.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4716	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133893220614245722"	chrome.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe
5232	alfa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5916	chrome.exe
Token: SeCreatePagefilePrivilege	5916	chrome.exe
Token: SeShutdownPrivilege	5916	chrome.exe
Token: SeCreatePagefilePrivilege	5916	chrome.exe
Token: SeShutdownPrivilege	5916	chrome.exe
Token: SeCreatePagefilePrivilege	5916	chrome.exe
Token: SeShutdownPrivilege	5916	chrome.exe
Token: SeCreatePagefilePrivilege	5916	chrome.exe
Token: SeShutdownPrivilege	5916	chrome.exe
Token: SeCreatePagefilePrivilege	5916	chrome.exe
Token: SeShutdownPrivilege	5916	chrome.exe
Token: SeCreatePagefilePrivilege	5916	chrome.exe
Token: SeShutdownPrivilege	5916	chrome.exe
Token: SeCreatePagefilePrivilege	5916	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
5916	chrome.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 5916	5232	alfa.exe	78
PID 5232 wrote to memory of 5916	5232	alfa.exe	78
PID 5916 wrote to memory of 3844	5916	chrome.exe	79
PID 5916 wrote to memory of 3844	5916	chrome.exe	79
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 5092	5916	chrome.exe	81
PID 5916 wrote to memory of 5092	5916	chrome.exe	81
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4952	5916	chrome.exe	80
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82
PID 5916 wrote to memory of 4496	5916	chrome.exe	82

C:\Users\Admin\AppData\Local\Temp\alfa.exe
"C:\Users\Admin\AppData\Local\Temp\alfa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf4d1dcf8,0x7ffbf4d1dd04,0x7ffbf4d1dd10
    3⤵
    PID:3844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2024,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:4952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1488,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=2132 /prefetch:11
    3⤵
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2376,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=2392 /prefetch:13
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4268,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=3880 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:5460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4784,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=4808 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5280,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:2176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5416,i,563415450019523832,7015737814335353288,262144 --variations-seed-version=20250410-184111.240000 --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
  2⤵
  - Uses browser remote debugging
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffbe423f208,0x7ffbe423f214,0x7ffbe423f220
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2100,i,4717986733223655875,4861636590074640772,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1860,i,4717986733223655875,4861636590074640772,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2392,i,4717986733223655875,4861636590074640772,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,4717986733223655875,4861636590074640772,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,4717986733223655875,4861636590074640772,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\iw479" & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2440
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 11
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4716

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
414B

MD5
6100224d539ec5c95f3731094844647d

SHA1
609c2961e4278bda65e7acbb1c062c52097219e3

SHA256
e0c19cba6114f0e0b22de10199ff4345bb4ac6aac4051ca8f2e433b67d3acd37

SHA512
595a88a3d6a9278c922713492c2291d876a56a22d9ead50150107b3bb1e62cabb9174c4b8035b24903de9cb6a4ec28ad1d0dfe1e9814a319d08e89ecdc485b27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
f6c772cefef70b2bff4f4323364c99a6

SHA1
8718f063674df14237f982ccc239354f5b56cef2

SHA256
cd8e68441eb03a4dd345c39eb9909b5f730248089f8f8c509830dfcf7a2a54c3

SHA512
8f1d0ec835cc064d7b11fb92197cf7dec8f843b11046f41d9cebe93912a5a0ed0074f6cec0c35c80eff5d7538581c026f50df1ab2307af5d656c6a3aba06983d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
f0a264821ad56f587ef8a5f5000b3cbd

SHA1
fa8ccbacc8036038543f20fea54b289f0b4fc0f8

SHA256
4a198d269b94f672544ed22c86c64f30b4e6fb3db8c4ffbde13759c6e16a2e48

SHA512
91f708803cc29b551649f039a8579c122f850698b580335813f90b9993a0b6b132ba119185f845666ddaaca5aa255ed14f3a0b34c8cccdd95ac24e0c53574117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
607fe914d36092c57b25eb2a56989dc9

SHA1
ff60d6ce3c41979861df24d74d783f087d14f86f

SHA256
8c6f6ac7a9f49a318c339d186371007f0e8cfb557f191aaa601bf6b904a26720

SHA512
85969e42dd331649bfe4ac1fe5216ced3b7b35ef992ff1be3c949869f5a4d72100f463be1f8925fc2395791dbb28038c7ed42da5c468c12f0a478677317806ef

Download Submit