maksrat | db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a

Analysis

max time kernel
101s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250502-en
submitted
10/06/2025, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a.jar
Size 19KB
Sample250610-h17bps1tfz
SHA256 db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a
MD5 cb4fc92a2d3a7ef8fb9b70b188ecf7c1
SHA1 26d6325063b789387e3304951431c837a9b6e78f
SHA512 2c3ab2797f38981108ad6cd607024a6d1b929c5f425c0b8024dd7db63388a9e818eb49afb08e54b04bdd80158d43d05c099c1253a6d4f8c5b66067703700645b
SSDEEP 384:9HtSKZOa3hEdtc5R55E792zdYVsv5pz7Og3eUVGJ+xysYKhyKJo:9HoVMt27AzdXv5pckYgEKC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

maksrat credential_access defense_evasion discovery stealer trojan

Malware Config

Signatures

Class file contains resources related to MaksRAT 1 IoCs

resource	yara_rule
sample	family_maksrat_class

MaksRAT
MaksRAT is a trojan written in Java.
trojan maksrat
Maksrat family
maksrat

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3888	chrome.exe
4344	chrome.exe
4320	msedge.exe
1216	msedge.exe
5312	msedge.exe
3616	chrome.exe
596	chrome.exe
4572	chrome.exe

Loads dropped DLL 2 IoCs

pid	Process
4456	java.exe
4456	java.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
4484	TASKKILL.exe
2808	TASKKILL.exe
2536	taskkill.exe
5044	taskkill.exe
708	taskkill.exe
4324	TASKKILL.exe
4760	TASKKILL.exe
2800	taskkill.exe
3528	taskkill.exe
1292	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe
3616	chrome.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	TASKKILL.exe
Token: SeDebugPrivilege	4484	TASKKILL.exe
Token: SeDebugPrivilege	4760	TASKKILL.exe
Token: SeDebugPrivilege	2808	TASKKILL.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	3528	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	708	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4320	msedge.exe
3616	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4456	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 4456	5460	java.exe	80
PID 5460 wrote to memory of 4456	5460	java.exe	80
PID 4456 wrote to memory of 4608	4456	java.exe	82
PID 4456 wrote to memory of 4608	4456	java.exe	82
PID 4456 wrote to memory of 4324	4456	java.exe	84
PID 4456 wrote to memory of 4324	4456	java.exe	84
PID 4456 wrote to memory of 4320	4456	java.exe	87
PID 4456 wrote to memory of 4320	4456	java.exe	87
PID 4320 wrote to memory of 224	4320	msedge.exe	88
PID 4320 wrote to memory of 224	4320	msedge.exe	88
PID 4320 wrote to memory of 1704	4320	msedge.exe	89
PID 4320 wrote to memory of 1704	4320	msedge.exe	89
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 4108	4320	msedge.exe	91
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 4108	4320	msedge.exe	91
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90
PID 4320 wrote to memory of 2124	4320	msedge.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\db91b5fe23374a5280616d15e9e667b6d89da148216cb7bef8cfe46dd870d17a.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar C:\Users\Admin\AppData\Local\Temp\downloaded3918541623537481093.jar 516022525688283136======================================================================================== Click Click Click 6657
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:4608
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ff928fef208,0x7ff928fef214,0x7ff928fef220
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2948,i,8444406575485097138,5874362506874973282,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:11
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2164,i,8444406575485097138,5874362506874973282,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2972,i,8444406575485097138,5874362506874973282,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3632,i,8444406575485097138,5874362506874973282,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3636,i,8444406575485097138,5874362506874973282,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1216
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:3616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0x104,0x114,0x7ff93a85dcf8,0x7ff93a85dd04,0x7ff93a85dd10
      4⤵
      PID:5084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=1996,i,6606978058402778818,4513193994726207975,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=1992 /prefetch:11
      4⤵
      PID:4680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,6606978058402778818,4513193994726207975,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=1952 /prefetch:2
      4⤵
      PID:4568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2368,i,6606978058402778818,4513193994726207975,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2364 /prefetch:13
      4⤵
      PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3612,i,6606978058402778818,4513193994726207975,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3652,i,6606978058402778818,4513193994726207975,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4316,i,6606978058402778818,4513193994726207975,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3572 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4732,i,6606978058402778818,4513193994726207975,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4728 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4344
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM chrome.exe /F"
    3⤵
    PID:1736
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM browser.exe /F"
    3⤵
    PID:3116
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM browser.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM brave.exe /F"
    3⤵
    PID:3968
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM brave.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM msedge.exe /F"
    3⤵
    PID:3844
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM msedge.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM opera.exe /F"
    3⤵
    PID:5516
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM opera.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1292
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM vivaldi.exe /F"
    3⤵
    PID:4584
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM vivaldi.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:708

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1564

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 f85e0a8eadcc866a926eb4d43368b8d4a23ddfde7b632d7a39fe3d8edf551c85
MD5 12b804bd4c1abbf06521bb9889196ed1
SHA1 8e593b531bc9693d8c55ae1a10216bd1b60aadbb
SHA512 a32adf09f6fb80ad0122a35761dc0e840064f3dd5ad5c8c8b7536ff50556d4dd2a599e8a59f2d89eba569a5e8a92fa64fb756556ff56eace0a7c454ab7c51d48
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 79KB
SHA256 eabc4b17588e75e76436e1406c19120fc0f3cd1c4dd5b5a9bf1868008eea18ca
MD5 68f4c39e77d1cb0412bea631b1f7a514
SHA1 4ed0c3ef764acc041de00d923a7c9268fe2878b8
SHA512 0f6765896922b7e9e5adf51d5f1c9f1ddb6d43e81ee95efbb81751cf66a1e0a5f023e6ec57d4d35410bd1774e6edc2dca59e27624c5917dbba599c1bac4444a7
SSDEEP 1536:wkSL8O4rHoxDEPsiy8JZGp2IRFN9lWa0pnSRE1oHaT:ELrxDAhJ0p2IHlK4REyHaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5badf790b6bff352277ba7f3a858b82446c7045d62372fb370cc554e47512197
MD5 12da43ffc4c0ccf5fed0934e6391e65f
SHA1 0f0d466230dd4311561dd2c95d5b37993e874645
SHA512 6a272b3c2bb43f17149ec1ebd806e4567e3de70e43dd578bb7c5d49b13d4eb8d49825aa6cd7a10579cb7c03cb3342f257565dbcea36fa817aba1b562352b016f
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c56031c5-195d-4784-a4d7-48921d28b893\index-dir\the-real-index
Size 2KB
SHA256 8ca2fd8c01702559a14506e93fa5bd1154c80f9dbfd34195da5f18a016366129
MD5 b9f868342827c380dcd500ee75aff28a
SHA1 39a5e84950c578fa5085b39a2d5e2b92557d37aa
SHA512 5d22cfa8b3cfb2f9a61e253130c24413cdb894455d861ad9f85d0f2fc630a7cc8cd92b23c182e0ff50ddcb2549fc0d63f44e08187d7a7af517010548dbe80a4c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57aff7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c56031c5-195d-4784-a4d7-48921d28b893\index-dir\the-real-index~RFe57aff7.TMP
Size 2KB
SHA256 d270abc7877a60d15e15883b10419783db69c0b2f2096f26b5924c9d751ebd38
MD5 5acad4f4286867d86ecf34b88fbde7d7
SHA1 d288069b94ef5ab6707c4f81a248026cbf5ed693
SHA512 e7a087b249fb293c2317fe819bb3797da8ca0c5dde6e5656c2aabb711b31ecdd5a84d627673d8c407e449ccb06eb729ffb1b6d2653c2b8b86db5793b02e2c5c1
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 56d871507d26de8671da9527f55a02b09d879ff0e345f90003693f7740ee1a9e
MD5 761bae6da6b1679c2e0d2e60d0d43c42
SHA1 9e3f86838d919f5a8e511c931ac4182b8ea620a6
SHA512 999f4638b27f8d8a02cb5c0c379fc629223cc03cf29b0610e1f4c27d610e16c4e2da5f08ad2f73831e7dd97f6249350286937b67c5bcfc000d9036d14df6fb6e
SSDEEP 768:mQiE6esE8lDldUGz3UwgD9oLLSyCRgvbvZtZjKTR91crW1o5pHQLCY6+Q:+eB85d7389SNVdjKNcrW67wOY6+Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8f09a9e38511e9d29a493882f961b312cbe483fcad344c6866652ddc83dfd011
MD5 cdb33d36f780d3843b0b6f9816561544
SHA1 3560816ca3e83585e39f37c60433dfe6876d6abb
SHA512 318185d59f76e8e40a5aeb3526fc3b249c8ddd7c2f7f9e42139817fc4828a421d789f7e23c629578f038e6f74e35b56ed5e52952a91faaf471bc9daa4b3d57bf
SSDEEP 768:0QiE6esE8lDldUGz3UwgDTRLSyCRgvbvZ7BJ373grW1o5pHQLCY6+Q:AeB85d738lNVNBJzgrW67wOY6+Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloaded3918541623537481093.jar

Path C:\Users\Admin\AppData\Local\Temp\downloaded3918541623537481093.jar
Size 8.5MB
SHA256 9d3c84ddd67bbf18887649e6b76ec1f7fcbce67d26f8ac1ac289f49ec92f7b0a
MD5 5a9f28b8ae99c827dcbc2975d0981b7c
SHA1 65fcbb1ef87ba4dcbc143b332963de6d10505676
SHA512 ebd9fc80e204271dc11af6a1d71237fc911227e862a8542607b59808da810b5f95640a988df067df5d397f28b49639cfc11976e7d66f416859796f5d8a29453f
SSDEEP 196608:LC/uTEhXxatoSQZag9PpjnKN5TnCOjVo0BaccZSiQp:LiuT8XxhCQOjPabZFa
MD5 SHA1 SHA512 SSDEEP

Submit Download

jna1845023311537997815.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna1845023311537997815.dll
Size 229KB
SHA256 cf8e552ee05cb0e872797ecffe0f9d3dc67e513748f3cd957f79e0f2f3d66ac2
MD5 cfebe457d00a97c2c5f8930bdbaae1f0
SHA1 526e95d2afde5ef07dd0aca671261dfbc7fcfa17
SHA512 fbded4dc03011e58219f622e724c0737475ce95a1a3619ca5e68babe5b734afc664523e93f96047e20d4d82411ccace0bac42f1dc77a2da2f94886ba04fab8a0
SSDEEP 3072:gTD0CYjMP9JCy+kveYFmAst0BpwekWV/5SZw1VVOeVDslm/m6yGfx:sOM9JCxk2QsyrKWRrslm/m6yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite-3.23.1-a2f76bb2-0d6e-4bfb-852c-aca8e1681745-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.23.1-a2f76bb2-0d6e-4bfb-852c-aca8e1681745-sqlitejdbc.dll
Size 957KB
SHA256 fec0f3e20c210da38ab477253389fd32ab80799a127315c2ef66527d6b6b84c3
MD5 5c1142470daec9631a71b589a2e17d7b
SHA1 87cd05cf4432ee6b4f6b1781059c27f1f816ec44
SHA512 b384ae9180abe61a5add7ad103761bb0d1990a8918bb99f5cee9c40fdd8d8fa79efb54cabf0ff131959bb3f38d70e4e5d305d24afb9c6ff35639cb1fbb3a1074
SSDEEP 24576:XiHVfKDHAHf9H98/7XRnIYl2ni52HoViBJL/90hT:yHVf4g/9H967BeBJL/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_bffb8f6a-c3c4-452c-a05b-8498cbe59783

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1245416451-815278583-4285364870-1000\83aa4cc77f591dfc2374580bbd95f6ba_bffb8f6a-c3c4-452c-a05b-8498cbe59783
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/4456-191-0x0000021338840000-0x0000021338850000-memory.dmp

Download

memory/4456-142-0x0000021338720000-0x0000021338730000-memory.dmp

Download

memory/4456-555-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-543-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-519-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-524-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-516-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-445-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-437-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-439-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-441-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-438-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-377-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-373-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-363-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-367-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-362-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-358-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-323-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-273-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-261-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-249-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-240-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-235-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-190-0x00000213387A0000-0x00000213387B0000-memory.dmp

Download

memory/4456-187-0x0000021338790000-0x00000213387A0000-memory.dmp

Download

memory/4456-188-0x0000021338830000-0x0000021338840000-memory.dmp

Download

memory/4456-184-0x0000021338780000-0x0000021338790000-memory.dmp

Download

memory/4456-185-0x0000021338820000-0x0000021338830000-memory.dmp

Download

memory/4456-183-0x0000021338810000-0x0000021338820000-memory.dmp

Download

memory/4456-182-0x0000021338770000-0x0000021338780000-memory.dmp

Download

memory/4456-143-0x0000021338730000-0x0000021338740000-memory.dmp

Download

memory/4456-178-0x0000021338760000-0x0000021338770000-memory.dmp

Download

memory/4456-179-0x0000021338800000-0x0000021338810000-memory.dmp

Download

memory/4456-175-0x0000021338750000-0x0000021338760000-memory.dmp

Download

memory/4456-176-0x00000213387F0000-0x0000021338800000-memory.dmp

Download

memory/4456-172-0x0000021338740000-0x0000021338750000-memory.dmp

Download

memory/4456-173-0x00000213387E0000-0x00000213387F0000-memory.dmp

Download

memory/4456-167-0x0000021338720000-0x0000021338730000-memory.dmp

Download

memory/4456-168-0x00000213387C0000-0x00000213387D0000-memory.dmp

Download

memory/4456-169-0x00000213387D0000-0x00000213387E0000-memory.dmp

Download

memory/4456-170-0x0000021338730000-0x0000021338740000-memory.dmp

Download

memory/4456-145-0x0000021338740000-0x0000021338750000-memory.dmp

Download

memory/4456-147-0x0000021338750000-0x0000021338760000-memory.dmp

Download

memory/4456-164-0x00000213387B0000-0x00000213387C0000-memory.dmp

Download

memory/4456-161-0x0000021338700000-0x0000021338710000-memory.dmp

Download

memory/4456-162-0x00000213387A0000-0x00000213387B0000-memory.dmp

Download

memory/4456-155-0x0000021338480000-0x00000213386F0000-memory.dmp

Download

memory/4456-157-0x0000021338790000-0x00000213387A0000-memory.dmp

Download

memory/4456-156-0x0000021338780000-0x0000021338790000-memory.dmp

Download

memory/4456-158-0x00000213386F0000-0x0000021338700000-memory.dmp

Download

memory/4456-153-0x0000021338770000-0x0000021338780000-memory.dmp

Download

memory/4456-121-0x0000021338480000-0x00000213386F0000-memory.dmp

Download

memory/4456-150-0x0000021338760000-0x0000021338770000-memory.dmp

Download

memory/4456-163-0x0000021338710000-0x0000021338720000-memory.dmp

Download

memory/4456-135-0x00000213386F0000-0x0000021338700000-memory.dmp

Download

memory/4456-137-0x0000021338700000-0x0000021338710000-memory.dmp

Download

memory/4456-138-0x0000021338460000-0x0000021338461000-memory.dmp

Download

memory/4456-139-0x0000021338710000-0x0000021338720000-memory.dmp

Download

memory/5460-86-0x000001C2AC310000-0x000001C2AC320000-memory.dmp

Download

memory/5460-76-0x000001C2AC2E0000-0x000001C2AC2F0000-memory.dmp

Download

memory/5460-40-0x000001C2AC2E0000-0x000001C2AC2F0000-memory.dmp

Download

memory/5460-109-0x000001C2AC370000-0x000001C2AC380000-memory.dmp

Download

memory/5460-39-0x000001C2AC240000-0x000001C2AC250000-memory.dmp

Download

memory/5460-37-0x000001C2AC220000-0x000001C2AC230000-memory.dmp

Download

memory/5460-116-0x000001C2AC3E0000-0x000001C2AC3F0000-memory.dmp

Download

memory/5460-115-0x000001C2AC3D0000-0x000001C2AC3E0000-memory.dmp

Download

memory/5460-114-0x000001C2AC3C0000-0x000001C2AC3D0000-memory.dmp

Download

memory/5460-113-0x000001C2AC3B0000-0x000001C2AC3C0000-memory.dmp

Download

memory/5460-112-0x000001C2AC3A0000-0x000001C2AC3B0000-memory.dmp

Download

memory/5460-111-0x000001C2AC390000-0x000001C2AC3A0000-memory.dmp

Download

memory/5460-110-0x000001C2AC380000-0x000001C2AC390000-memory.dmp

Download

memory/5460-107-0x000001C2AC360000-0x000001C2AC370000-memory.dmp

Download

memory/5460-105-0x000001C2AC350000-0x000001C2AC360000-memory.dmp

Download

memory/5460-104-0x000001C2AA6D0000-0x000001C2AA6D1000-memory.dmp

Download

memory/5460-102-0x000001C2AC340000-0x000001C2AC350000-memory.dmp

Download

memory/5460-103-0x000001C2AC3E0000-0x000001C2AC3F0000-memory.dmp

Download

memory/5460-100-0x000001C2AA6D0000-0x000001C2AA6D1000-memory.dmp

Download

memory/5460-95-0x000001C2AC330000-0x000001C2AC340000-memory.dmp

Download

memory/5460-96-0x000001C2AC3D0000-0x000001C2AC3E0000-memory.dmp

Download

memory/5460-92-0x000001C2AA6D0000-0x000001C2AA6D1000-memory.dmp

Download

memory/5460-89-0x000001C2AC320000-0x000001C2AC330000-memory.dmp

Download

memory/5460-90-0x000001C2AC3C0000-0x000001C2AC3D0000-memory.dmp

Download

memory/5460-87-0x000001C2AC3B0000-0x000001C2AC3C0000-memory.dmp

Download

memory/5460-80-0x000001C2AC300000-0x000001C2AC310000-memory.dmp

Download

memory/5460-79-0x000001C2AC2F0000-0x000001C2AC300000-memory.dmp

Download

memory/5460-81-0x000001C2AC390000-0x000001C2AC3A0000-memory.dmp

Download

memory/5460-83-0x000001C2AC3A0000-0x000001C2AC3B0000-memory.dmp

Download

memory/5460-75-0x000001C2AC380000-0x000001C2AC390000-memory.dmp

Download

memory/5460-2-0x000001C2ABFB0000-0x000001C2AC220000-memory.dmp

Download

memory/5460-36-0x000001C2AC2C0000-0x000001C2AC2D0000-memory.dmp

Download

memory/5460-73-0x000001C2AC2C0000-0x000001C2AC2D0000-memory.dmp

Download

memory/5460-74-0x000001C2AC370000-0x000001C2AC380000-memory.dmp

Download

memory/5460-69-0x000001C2AC2B0000-0x000001C2AC2C0000-memory.dmp

Download

memory/5460-71-0x000001C2AC360000-0x000001C2AC370000-memory.dmp

Download

memory/5460-70-0x000001C2AC2D0000-0x000001C2AC2E0000-memory.dmp

Download

memory/5460-38-0x000001C2AC230000-0x000001C2AC240000-memory.dmp

Download

memory/5460-28-0x000001C2AC2A0000-0x000001C2AC2B0000-memory.dmp

Download

memory/5460-27-0x000001C2AC290000-0x000001C2AC2A0000-memory.dmp

Download

memory/5460-24-0x000001C2AC280000-0x000001C2AC290000-memory.dmp

Download

memory/5460-21-0x000001C2AC260000-0x000001C2AC270000-memory.dmp

Download

memory/5460-65-0x000001C2AC2A0000-0x000001C2AC2B0000-memory.dmp

Download

memory/5460-22-0x000001C2AC270000-0x000001C2AC280000-memory.dmp

Download

memory/5460-18-0x000001C2AC250000-0x000001C2AC260000-memory.dmp

Download

memory/5460-66-0x000001C2AC350000-0x000001C2AC360000-memory.dmp

Download

memory/5460-59-0x000001C2AC290000-0x000001C2AC2A0000-memory.dmp

Download

memory/5460-60-0x000001C2AC340000-0x000001C2AC350000-memory.dmp

Download

memory/5460-55-0x000001C2AC330000-0x000001C2AC340000-memory.dmp

Download

memory/5460-54-0x000001C2AC280000-0x000001C2AC290000-memory.dmp

Download

memory/5460-51-0x000001C2AC270000-0x000001C2AC280000-memory.dmp

Download

memory/5460-52-0x000001C2AC320000-0x000001C2AC330000-memory.dmp

Download

memory/5460-45-0x000001C2AC2F0000-0x000001C2AC300000-memory.dmp

Download

memory/5460-46-0x000001C2AC300000-0x000001C2AC310000-memory.dmp

Download

memory/5460-49-0x000001C2AC260000-0x000001C2AC270000-memory.dmp

Download

memory/5460-50-0x000001C2AC310000-0x000001C2AC320000-memory.dmp

Download

memory/5460-17-0x000001C2AC240000-0x000001C2AC250000-memory.dmp

Download

memory/5460-47-0x000001C2AC250000-0x000001C2AC260000-memory.dmp

Download

memory/5460-42-0x000001C2AA6D0000-0x000001C2AA6D1000-memory.dmp

Download

memory/5460-33-0x000001C2ABFB0000-0x000001C2AC220000-memory.dmp

Download

memory/5460-34-0x000001C2AC2B0000-0x000001C2AC2C0000-memory.dmp

Download

memory/5460-35-0x000001C2AC2D0000-0x000001C2AC2E0000-memory.dmp

Download

memory/5460-14-0x000001C2AC230000-0x000001C2AC240000-memory.dmp

Download

memory/5460-12-0x000001C2AC220000-0x000001C2AC230000-memory.dmp

Download