maksrat | db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a

Analysis

max time kernel
106s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
submitted
10/06/2025, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a.jar
Size 19KB
Sample250610-h17bps1tfz
SHA256 db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a
MD5 cb4fc92a2d3a7ef8fb9b70b188ecf7c1
SHA1 26d6325063b789387e3304951431c837a9b6e78f
SHA512 2c3ab2797f38981108ad6cd607024a6d1b929c5f425c0b8024dd7db63388a9e818eb49afb08e54b04bdd80158d43d05c099c1253a6d4f8c5b66067703700645b
SSDEEP 384:9HtSKZOa3hEdtc5R55E792zdYVsv5pz7Og3eUVGJ+xysYKhyKJo:9HoVMt27AzdXv5pckYgEKC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

maksrat credential_access defense_evasion discovery stealer trojan

Malware Config

Signatures

Class file contains resources related to MaksRAT 1 IoCs

resource	yara_rule
sample	family_maksrat_class

MaksRAT
MaksRAT is a trojan written in Java.
trojan maksrat
Maksrat family
maksrat

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4200	chrome.exe
212	chrome.exe
1920	msedge.exe
4152	msedge.exe
1420	chrome.exe
4232	chrome.exe
2388	chrome.exe
1472	msedge.exe
3304	msedge.exe

Loads dropped DLL 2 IoCs

pid	Process
1848	java.exe
1848	java.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
4420	taskkill.exe
4548	taskkill.exe
2840	TASKKILL.exe
2444	TASKKILL.exe
4660	TASKKILL.exe
4504	taskkill.exe
4152	TASKKILL.exe
2920	taskkill.exe
4300	taskkill.exe
2244	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1420	chrome.exe
1420	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	TASKKILL.exe
Token: SeDebugPrivilege	2444	TASKKILL.exe
Token: SeDebugPrivilege	4660	TASKKILL.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeDebugPrivilege	4152	TASKKILL.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	4420	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1420	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1848	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 1848	3588	java.exe	95
PID 3588 wrote to memory of 1848	3588	java.exe	95
PID 1848 wrote to memory of 1036	1848	java.exe	97
PID 1848 wrote to memory of 1036	1848	java.exe	97
PID 1848 wrote to memory of 2840	1848	java.exe	99
PID 1848 wrote to memory of 2840	1848	java.exe	99
PID 1848 wrote to memory of 1920	1848	java.exe	101
PID 1848 wrote to memory of 1920	1848	java.exe	101
PID 1920 wrote to memory of 3244	1920	msedge.exe	102
PID 1920 wrote to memory of 3244	1920	msedge.exe	102
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 4612	1920	msedge.exe	104
PID 1920 wrote to memory of 4612	1920	msedge.exe	104
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 428	1920	msedge.exe	103
PID 1920 wrote to memory of 1472	1920	msedge.exe	106

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar C:\Users\Admin\AppData\Local\Temp\downloaded6835282852121629929.jar 516022525688283136======================================================================================== Click Click Click 6657
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:1036
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7fff607cf208,0x7fff607cf214,0x7fff607cf220
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2212,i,2619284428062776540,4737340138459511596,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2240,i,2619284428062776540,4737340138459511596,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2736,i,2619284428062776540,4737340138459511596,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3424,i,2619284428062776540,4737340138459511596,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4312,i,2619284428062776540,4737340138459511596,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4344,i,2619284428062776540,4737340138459511596,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=5092,i,2619284428062776540,4737340138459511596,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      PID:4372
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff5fecdcf8,0x7fff5fecdd04,0x7fff5fecdd10
      4⤵
      PID:2324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2008,i,13638542414524062408,9695868672589537206,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=1984 /prefetch:2
      4⤵
      PID:3176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --subproc-heap-profiling --field-trial-handle=2284,i,13638542414524062408,9695868672589537206,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=1836 /prefetch:3
      4⤵
      PID:3244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --subproc-heap-profiling --field-trial-handle=2840,i,13638542414524062408,9695868672589537206,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2828 /prefetch:8
      4⤵
      PID:3376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3336,i,13638542414524062408,9695868672589537206,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3368,i,13638542414524062408,9695868672589537206,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4276,i,13638542414524062408,9695868672589537206,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4272 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --subproc-heap-profiling --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4524,i,13638542414524062408,9695868672589537206,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2388
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM chrome.exe /F"
    3⤵
    PID:5080
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM browser.exe /F"
    3⤵
    PID:3652
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM browser.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM brave.exe /F"
    3⤵
    PID:4376
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM brave.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2244
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM msedge.exe /F"
    3⤵
    PID:2372
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM msedge.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4504
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM opera.exe /F"
    3⤵
    PID:1752
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM opera.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM vivaldi.exe /F"
    3⤵
    PID:3288
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM vivaldi.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2084

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 139299a91128218046684eae23b7c8e68c080778cf4c69ab92ce5ac9183894fc
MD5 2dd01a3fd12cb00710c2d2406bb1152f
SHA1 a184e4b16ca84f2b972f8df584e71a091b9d159a
SHA512 dc41943f484c1d18e5c4cabddc4840ec26aa1f537744e2ceb5e0d567e4131a6ea912640afe9c22996af3c82352d47bd5b74b806dd28d72c85e039edd479eb592
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 79KB
SHA256 1b891b0413ccb20bbbbace2f88415104a3c8440dd977fdae1c3335f6fea42a86
MD5 b02c145a87335210bcfbcc76ec4f5a49
SHA1 01b9962a2dc5311a8f4faed6a8cc37e8f720ca8b
SHA512 fb842a58cd84aef3460e1494b2b169a6e45c4b39f95d014bbb2426dd9a0ed14bc38d7a1f0f94e20434b5c0e7a723ee8e0fd153e5385e7e8644fc5cee72d9d29e
SSDEEP 1536:OjDL8O4rHoxDEPsiy8JZGp2IRFN9lWa0pnSRE1oHaM:GLrxDAhJ0p2IHlK4REyHaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8d3ffdbd57fae7374a0dbba31ebb5384e92f5ccd0e6cf8a472774e2f3558c1c3
MD5 86d82964f0f1af65f5670160f2760633
SHA1 7e2814924a303a2681bd348359032cb5241c536c
SHA512 9f7d3f4136bbbbd23ada4aaab910ae773ee7452fd03298ee4a2ea7b3d0477487b7640500de62d31d53f9684e835414e1c2b6447e268325db07d92134272e1e62
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a9a4dc3eca105b08d2a13e7399cd73db214eadad2bc8893d87eee5e93227ea9
MD5 3e2d3f54d45c5239d94ff524828e2a3f
SHA1 7e4be8132f34e8d1c8be73eaf7e0f47942fbbdd4
SHA512 3a747f1d79e8e89ed3ac4645f1f223aa9b27271dae733c94d4d06c13b512bbd10206897ac7b0a7f25679085f44659a947f9455139329df9b43476cbabdd6381b
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 6KB
SHA256 cbd49f92885b95ad3a5e01d48e089f1216190fc573c9519faaa4829caff27ab9
MD5 853b1e4b4a3f7819b265b5e4c2627d7d
SHA1 bcbc07c80a5076a22687419e6c28735ebccf8d72
SHA512 2394a4044fe36334482aa1876e52dbb629570207ec8b14389f345bfaa5ccb858242e3ca2c7395412b47d880a148cd3835739560ec9de51a8f78286164fbd90eb
SSDEEP 96:qqONkCyUfCm4NQe7Gj5ih/cIVURLl8RotopsEnBPPHvQaSwB25NOn4Ze4mJlh0t6:hONbyXJNFWiRUsX1SQ2an48lhf9W6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 1be5cf2348dcdd2ebcd08752b5a12c7903c43a9e202ecd6c91b6a9664b011794
MD5 857fc312fd0226ee4c8ba1d22ade457b
SHA1 f10e08b43325ba48b231e860b8dadf23e11affe6
SHA512 bc8eb56d9d946ef458b5b226abfcaea9710dad570bc70b0333509a09f10c32bc84d0ca3d1ab887915d6f90e87d7465ea48028afbfd259eb5025edc60ca266717
SSDEEP 96:cqONkCyUfCm4NQe7Pj5ih/cIVURLl8Rotops9nBJPHvQaSwB25NgEmvkhseRpZeO:HONbyXJNUWiRUzB1SQ2MEek2eRp836
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloaded6835282852121629929.jar

Path C:\Users\Admin\AppData\Local\Temp\downloaded6835282852121629929.jar
Size 8.5MB
SHA256 9d3c84ddd67bbf18887649e6b76ec1f7fcbce67d26f8ac1ac289f49ec92f7b0a
MD5 5a9f28b8ae99c827dcbc2975d0981b7c
SHA1 65fcbb1ef87ba4dcbc143b332963de6d10505676
SHA512 ebd9fc80e204271dc11af6a1d71237fc911227e862a8542607b59808da810b5f95640a988df067df5d397f28b49639cfc11976e7d66f416859796f5d8a29453f
SSDEEP 196608:LC/uTEhXxatoSQZag9PpjnKN5TnCOjVo0BaccZSiQp:LiuT8XxhCQOjPabZFa
MD5 SHA1 SHA512 SSDEEP

Submit Download

jna3296868619251753635.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna3296868619251753635.dll
Size 229KB
SHA256 cf8e552ee05cb0e872797ecffe0f9d3dc67e513748f3cd957f79e0f2f3d66ac2
MD5 cfebe457d00a97c2c5f8930bdbaae1f0
SHA1 526e95d2afde5ef07dd0aca671261dfbc7fcfa17
SHA512 fbded4dc03011e58219f622e724c0737475ce95a1a3619ca5e68babe5b734afc664523e93f96047e20d4d82411ccace0bac42f1dc77a2da2f94886ba04fab8a0
SSDEEP 3072:gTD0CYjMP9JCy+kveYFmAst0BpwekWV/5SZw1VVOeVDslm/m6yGfx:sOM9JCxk2QsyrKWRrslm/m6yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite-3.23.1-48ef51eb-c9d4-460d-944d-e612e9f2f84e-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.23.1-48ef51eb-c9d4-460d-944d-e612e9f2f84e-sqlitejdbc.dll
Size 957KB
SHA256 fec0f3e20c210da38ab477253389fd32ab80799a127315c2ef66527d6b6b84c3
MD5 5c1142470daec9631a71b589a2e17d7b
SHA1 87cd05cf4432ee6b4f6b1781059c27f1f816ec44
SHA512 b384ae9180abe61a5add7ad103761bb0d1990a8918bb99f5cee9c40fdd8d8fa79efb54cabf0ff131959bb3f38d70e4e5d305d24afb9c6ff35639cb1fbb3a1074
SSDEEP 24576:XiHVfKDHAHf9H98/7XRnIYl2ni52HoViBJL/90hT:yHVf4g/9H967BeBJL/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_94d08b09-52e4-4a11-be9b-1284fca5cf3a

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3674642747-2260306818-3009887879-1000\83aa4cc77f591dfc2374580bbd95f6ba_94d08b09-52e4-4a11-be9b-1284fca5cf3a
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/1848-184-0x000001F180300000-0x000001F180310000-memory.dmp

Download

memory/1848-166-0x000001F180290000-0x000001F1802A0000-memory.dmp

Download

memory/1848-344-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-343-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-355-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-316-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-273-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-265-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-239-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-228-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-194-0x000001F180320000-0x000001F180330000-memory.dmp

Download

memory/1848-195-0x000001F1803C0000-0x000001F1803D0000-memory.dmp

Download

memory/1848-189-0x000001F180310000-0x000001F180320000-memory.dmp

Download

memory/1848-190-0x000001F1803B0000-0x000001F1803C0000-memory.dmp

Download

memory/1848-188-0x000001F1803A0000-0x000001F1803B0000-memory.dmp

Download

memory/1848-183-0x000001F1802F0000-0x000001F180300000-memory.dmp

Download

memory/1848-185-0x000001F180390000-0x000001F1803A0000-memory.dmp

Download

memory/1848-365-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-180-0x000001F1802E0000-0x000001F1802F0000-memory.dmp

Download

memory/1848-181-0x000001F180380000-0x000001F180390000-memory.dmp

Download

memory/1848-178-0x000001F1802D0000-0x000001F1802E0000-memory.dmp

Download

memory/1848-179-0x000001F180370000-0x000001F180380000-memory.dmp

Download

memory/1848-174-0x000001F1802C0000-0x000001F1802D0000-memory.dmp

Download

memory/1848-175-0x000001F180360000-0x000001F180370000-memory.dmp

Download

memory/1848-172-0x000001F180350000-0x000001F180360000-memory.dmp

Download

memory/1848-339-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-167-0x000001F180330000-0x000001F180340000-memory.dmp

Download

memory/1848-168-0x000001F180340000-0x000001F180350000-memory.dmp

Download

memory/1848-169-0x000001F1802A0000-0x000001F1802B0000-memory.dmp

Download

memory/1848-170-0x000001F1802B0000-0x000001F1802C0000-memory.dmp

Download

memory/1848-162-0x000001F180280000-0x000001F180290000-memory.dmp

Download

memory/1848-163-0x000001F180320000-0x000001F180330000-memory.dmp

Download

memory/1848-155-0x000001F1802F0000-0x000001F180300000-memory.dmp

Download

memory/1848-156-0x000001F180300000-0x000001F180310000-memory.dmp

Download

memory/1848-158-0x000001F180000000-0x000001F180270000-memory.dmp

Download

memory/1848-159-0x000001F180310000-0x000001F180320000-memory.dmp

Download

memory/1848-160-0x000001F180270000-0x000001F180280000-memory.dmp

Download

memory/1848-152-0x000001F1802E0000-0x000001F1802F0000-memory.dmp

Download

memory/1848-149-0x000001F1802D0000-0x000001F1802E0000-memory.dmp

Download

memory/1848-144-0x000001F1802A0000-0x000001F1802B0000-memory.dmp

Download

memory/1848-148-0x000001F1802C0000-0x000001F1802D0000-memory.dmp

Download

memory/1848-145-0x000001F1802B0000-0x000001F1802C0000-memory.dmp

Download

memory/1848-141-0x000001F180290000-0x000001F1802A0000-memory.dmp

Download

memory/1848-139-0x000001F180280000-0x000001F180290000-memory.dmp

Download

memory/1848-136-0x000001F180270000-0x000001F180280000-memory.dmp

Download

memory/1848-134-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-381-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-391-0x000001F1F2C70000-0x000001F1F2C71000-memory.dmp

Download

memory/1848-122-0x000001F180000000-0x000001F180270000-memory.dmp

Download

memory/3588-68-0x000001C70C950000-0x000001C70C960000-memory.dmp

Download

memory/3588-71-0x000001C70C960000-0x000001C70C970000-memory.dmp

Download

memory/3588-116-0x000001C70CA80000-0x000001C70CA90000-memory.dmp

Download

memory/3588-115-0x000001C70CA70000-0x000001C70CA80000-memory.dmp

Download

memory/3588-114-0x000001C70CA60000-0x000001C70CA70000-memory.dmp

Download

memory/3588-113-0x000001C70CA50000-0x000001C70CA60000-memory.dmp

Download

memory/3588-112-0x000001C70AC70000-0x000001C70AC71000-memory.dmp

Download

memory/3588-111-0x000001C70CA40000-0x000001C70CA50000-memory.dmp

Download

memory/3588-109-0x000001C70CA30000-0x000001C70CA40000-memory.dmp

Download

memory/3588-108-0x000001C70CA20000-0x000001C70CA30000-memory.dmp

Download

memory/3588-107-0x000001C70CA10000-0x000001C70CA20000-memory.dmp

Download

memory/3588-105-0x000001C70CA00000-0x000001C70CA10000-memory.dmp

Download

memory/3588-104-0x000001C70AC70000-0x000001C70AC71000-memory.dmp

Download

memory/3588-103-0x000001C70CA90000-0x000001C70CAA0000-memory.dmp

Download

memory/3588-102-0x000001C70C9F0000-0x000001C70CA00000-memory.dmp

Download

memory/3588-95-0x000001C70C9E0000-0x000001C70C9F0000-memory.dmp

Download

memory/3588-96-0x000001C70CA80000-0x000001C70CA90000-memory.dmp

Download

memory/3588-92-0x000001C70AC70000-0x000001C70AC71000-memory.dmp

Download

memory/3588-90-0x000001C70CA70000-0x000001C70CA80000-memory.dmp

Download

memory/3588-89-0x000001C70C9D0000-0x000001C70C9E0000-memory.dmp

Download

memory/3588-87-0x000001C70CA60000-0x000001C70CA70000-memory.dmp

Download

memory/3588-86-0x000001C70C9C0000-0x000001C70C9D0000-memory.dmp

Download

memory/3588-82-0x000001C70C9A0000-0x000001C70C9B0000-memory.dmp

Download

memory/3588-83-0x000001C70CA50000-0x000001C70CA60000-memory.dmp

Download

memory/3588-80-0x000001C70C9B0000-0x000001C70C9C0000-memory.dmp

Download

memory/3588-81-0x000001C70CA40000-0x000001C70CA50000-memory.dmp

Download

memory/3588-79-0x000001C70C990000-0x000001C70C9A0000-memory.dmp

Download

memory/3588-72-0x000001C70C980000-0x000001C70C990000-memory.dmp

Download

memory/3588-73-0x000001C70CA20000-0x000001C70CA30000-memory.dmp

Download

memory/3588-74-0x000001C70CA30000-0x000001C70CA40000-memory.dmp

Download

memory/3588-75-0x000001C70C970000-0x000001C70C980000-memory.dmp

Download

memory/3588-117-0x000001C70CA90000-0x000001C70CAA0000-memory.dmp

Download

memory/3588-69-0x000001C70CA10000-0x000001C70CA20000-memory.dmp

Download

memory/3588-2-0x000001C70C660000-0x000001C70C8D0000-memory.dmp

Download

memory/3588-66-0x000001C70C940000-0x000001C70C950000-memory.dmp

Download

memory/3588-67-0x000001C70CA00000-0x000001C70CA10000-memory.dmp

Download

memory/3588-61-0x000001C70C9F0000-0x000001C70CA00000-memory.dmp

Download

memory/3588-60-0x000001C70C930000-0x000001C70C940000-memory.dmp

Download

memory/3588-55-0x000001C70C920000-0x000001C70C930000-memory.dmp

Download

memory/3588-56-0x000001C70C9E0000-0x000001C70C9F0000-memory.dmp

Download

memory/3588-44-0x000001C70C8F0000-0x000001C70C900000-memory.dmp

Download

memory/3588-45-0x000001C70C9A0000-0x000001C70C9B0000-memory.dmp

Download

memory/3588-50-0x000001C70C910000-0x000001C70C920000-memory.dmp

Download

memory/3588-51-0x000001C70C9D0000-0x000001C70C9E0000-memory.dmp

Download

memory/3588-46-0x000001C70C9B0000-0x000001C70C9C0000-memory.dmp

Download

memory/3588-47-0x000001C70C900000-0x000001C70C910000-memory.dmp

Download

memory/3588-48-0x000001C70C9C0000-0x000001C70C9D0000-memory.dmp

Download

memory/3588-41-0x000001C70AC70000-0x000001C70AC71000-memory.dmp

Download

memory/3588-32-0x000001C70C660000-0x000001C70C8D0000-memory.dmp

Download

memory/3588-34-0x000001C70C980000-0x000001C70C990000-memory.dmp

Download

memory/3588-38-0x000001C70C8E0000-0x000001C70C8F0000-memory.dmp

Download

memory/3588-39-0x000001C70C990000-0x000001C70C9A0000-memory.dmp

Download

memory/3588-35-0x000001C70C970000-0x000001C70C980000-memory.dmp

Download

memory/3588-36-0x000001C70C8D0000-0x000001C70C8E0000-memory.dmp

Download

memory/3588-33-0x000001C70C960000-0x000001C70C970000-memory.dmp

Download

memory/3588-28-0x000001C70C950000-0x000001C70C960000-memory.dmp

Download

memory/3588-26-0x000001C70C940000-0x000001C70C950000-memory.dmp

Download

memory/3588-24-0x000001C70C930000-0x000001C70C940000-memory.dmp

Download

memory/3588-23-0x000001C70C920000-0x000001C70C930000-memory.dmp

Download

memory/3588-20-0x000001C70C910000-0x000001C70C920000-memory.dmp

Download

memory/3588-19-0x000001C70C900000-0x000001C70C910000-memory.dmp

Download

memory/3588-16-0x000001C70C8F0000-0x000001C70C900000-memory.dmp

Download

memory/3588-14-0x000001C70C8E0000-0x000001C70C8F0000-memory.dmp

Download

memory/3588-12-0x000001C70C8D0000-0x000001C70C8E0000-memory.dmp

Download