4f11e355a779546dfc53e15abb176a51b44e408d9f097dd6a90c0e2122fcf3bf

Analysis

max time kernel
142s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2023, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

obabma.jpg
Size

191KB
MD5

992fc3e7a36d29ba14254c3f05d2e649
SHA1

a80c4610659b747aee95ee6c4c22d28b768710d7
SHA256

4f11e355a779546dfc53e15abb176a51b44e408d9f097dd6a90c0e2122fcf3bf
SHA512

6d83a3d0454789ff9e6c5711ab2a8b5a41fb7acf29a2bd70f6e65a6700d6a69a9bda79166e855259aad863b0a2aeadad7dabb5d975f03fa3916ce031d93cd842
SSDEEP

3072:mQ0oK8mIc5T/sXOcg6e+EmDFYl0/JqEBHRpUdMrXCK0K6wTWKNDEUXUFeJokBMn3:mPohc5T0XORIYm/JdxSb3wT1EYUFCXq3

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	LogonUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9ab6598-0000-0000-0000-d01200000000}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9ab6598-0000-0000-0000-d01200000000}\MaxCapacity = "15140"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9ab6598-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "87"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "87"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2275444769-3691835758-4097679484-1000\{EFA220DE-0869-46DF-9DDD-1771F89D6F92}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2088	LogonUI.exe
Token: SeCreatePagefilePrivilege	2088	LogonUI.exe
Token: SeShutdownPrivilege	1712	LogonUI.exe
Token: SeCreatePagefilePrivilege	1712	LogonUI.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2088	LogonUI.exe
1712	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 888	2272	msedge.exe	102
PID 2272 wrote to memory of 888	2272	msedge.exe	102
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 2804	2272	msedge.exe	103
PID 2272 wrote to memory of 3752	2272	msedge.exe	104
PID 2272 wrote to memory of 3752	2272	msedge.exe	104
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106
PID 2272 wrote to memory of 2172	2272	msedge.exe	106

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\obabma.jpg
1⤵
PID:1356

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa398a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freenom.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffe393b46f8,0x7ffe393b4708,0x7ffe393b4718
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17435395430194277011,15141282363628557092,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17435395430194277011,15141282363628557092,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17435395430194277011,15141282363628557092,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17435395430194277011,15141282363628557092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17435395430194277011,15141282363628557092,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17435395430194277011,15141282363628557092,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39a7855 /state1:0x41c64e6d
1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-2275444769-3691835758-4097679484-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg

Filesize
143KB

MD5
c8958ed84c10b936ac7bdfbf8ed1e108

SHA1
651e133ea52b2dc5973f21dc15cde0d1dac9ab20

SHA256
0b9456bdd59995241ac7749c65f3e984f2902c684b9d779a28b6006a87e0e85f

SHA512
df709ff3584730c26362235ac01acd26e1b97cbb90a8f332bc96bd36134547bf47da60f87192d27aab0e6b7674af81999555b1d5b0e73551353e877fad7c360a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
099b4ba2787e99b696fc61528100f83f

SHA1
06e1f8b7391e1d548e49a1022f6ce6e7aa61f292

SHA256
cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8

SHA512
4309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c2f1cd5ad5399f97b310e4ffee2ca677

SHA1
f4c40edba53a8a73473f1885561f4c8ec73fd1db

SHA256
cd232c442c092455f3c29d1b1ab35802560d1ad54ab3d017f6c285a565655f30

SHA512
36d051ac2644c3b263504a6a5b2e7b8929283daa26080401ca9426e654a60028bb1cd93c1b51883d852fd4adecb11fe2f17db71e87df9e54dab534d1c245be07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d532.TMP

Filesize
48B

MD5
cfffbafe3b2dc7e3b5b291ef7f668da1

SHA1
41ebd9c0f70f3f2bd1c043f8667553ab039131fd

SHA256
9bb1ad9530731cc0a574bb8995ad134aad4759e4aadbb0481127e8449d19e7f2

SHA512
1decccf7755a4a48cd8a084e544c8d9acc55cbc2c812c2e3eccec2463066349e46a731cbb41c65119b12c53209529d75c0ffb57aa78d4860e72cfb50912c6a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
1c259a5752ed9dc16be170bc30b550c2

SHA1
54eb6754aa97fc603fe4eb39820bda1256b9a3c4

SHA256
6e375717fc749a875ccd87eb3de8cabce17031c2372f83b2a0837c4432fd60a6

SHA512
0e63bf5588352d7115633fd9b9770c194b23300998f65a16afe0bc229f4df3d1b684bb3c33cda386b40c715ce4d80e7416ebacb44c8d77b0bfea2b8e9a761a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8b5ed8ac4a3bb626fac2329a75ffbba2

SHA1
b34fa70f9f62b016d53037ea23cf65ff3904a01f

SHA256
53d96be2f5cf3ca3894d9a0912fe34aa23ca5e5bfdbc4339f22862993755ce86

SHA512
dc87adf14e09734eab5dfa5fd6b20c3073fc7c12c5ca1210fa1849e8388254542e6772962353989e0666634d0515ade7be3123ab35434aaf21db68e54be51872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13df5b253045deb2b167d14660df62e6

SHA1
31ce94eedcbce375bb945c440b492394e514c71a

SHA256
e91addaa9bcdc032f7aa87131b95941b3d7a71e59115b1dee45eb69bda78650c

SHA512
3f88e2450b83c41440e21cf944f9bdd9b8deacadb4a4f32dd373490e2aeaa6559584334f139b1d2ab708059510853d80aefaaa1d7d23acb4f28c096d03a5dfe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
2904fef317bcb2cac62abfab4ef5fcd3

SHA1
8db071f5b58d59156226f3a6aa919d54a11a7992

SHA256
a3609a85f9ccf3e81fda386db634188ebf15a106c3592f0c02142bf5b8a5fe3d

SHA512
a83148b22d899cbd92f676a7d4295f4a4453da077f1e746c96cc2c1766e2296deb1636eaba8bd583bb7859f9defabd0c3937680e9e3d52aec393073ad81210a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b77f254d35822b01ddecf2c3fd34303

SHA1
737c6c9421e3442365c974a601c6c2236ab3904f

SHA256
67cfe61d25a4e34f9f267b78907e5b4e695aeb05120ae73407ffb6894d52cc72

SHA512
19229daf7b9ce45da2ade936eac464b1ec6da90c81b5abda1547aa5872f1f46eabae5995e847966b520aa4bc3e90704055ad8e328a649139de263dbc8c38c6b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e091d79290343b69bfdb78fa797435b

SHA1
c0749acc0c30f7f4525f6d97d9475a2271acf52f

SHA256
4389e8c0792fa61b2a0c89143e8dd9380c8702d8a00969754996cd1358655895

SHA512
3beed350026a50949ff6bac08e490a07ffac2530386a6112f05c61bfe4817e03c505d3d840970ab07df194c81ad42ee3caaa5486d856a01992f02b564d15596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0d8526828a15539cdfc1ebe8491b683

SHA1
0998822416573931e89b27cc2104b10c5e6ff5dd

SHA256
06667ed5c4a9e5fd0acba4fa028df047adcf5e3ac59148dd545b61698a20508b

SHA512
faf2109d42454e0d3d95c74dcc6ef551b516e8515380495515d90da73f80fc5b8cbeb012ebecbe238dd8db45d24fabeebb30705c47c8e4a2da9b1a83a428fa85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3966348bbd403f0d73c498b32b42c474

SHA1
e831a80dc7540db9afced875d230530380ec5119

SHA256
85295f1484a81c8e36f1287dbb3d8c2ff4f80a5b2dc0985b88abcf49850d7542

SHA512
75a7fe567b809507d121ecfccd5cb85d7dc8e64609f916a450345a1ba959f7535767619970de25f9474c498666ad1b08250697222d5696f7a589f663a035c41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
46a5e811856481fb24561b093302c907

SHA1
0f8c6b9f171075beccc72f73e216fa79d4c65b63

SHA256
34b4d8509a24fd01461d2252d3a2ca4e7e70d84d805fa0f401f24ad6567dced0

SHA512
60f3f2d2a908add726cc589d02470f447cdf9b28aa15dded08137ebfbe8efb186dbf532407a01486cca665bb64db9af80ea7c2c4097ccc4522e74de18ff2b392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
fbb6843d644c6f6ee0af745b6020fc5f

SHA1
edda050662dd898f5c32dfb54913bd68f18786bf

SHA256
b6b3c6d6bd1ebdb49a0e22c994c76ee44d1a7b60a4cb8f70497aaa99e69b26c8

SHA512
be86a310ace27f205c66428ee62590b931c487dcd53f624c00397d6cae89a94306e35abf94a937b142c0dfff78c1814febbc2e4ba0f6a20181c6e85cc4007b16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ef7e1028d2670f8ac1b0602bdad9ceda

SHA1
df0985e3fd4295161560d343d6b3af8ae456c0d6

SHA256
72d5ee23b7732cc2cb3086846ac804d24be16bfa4e1ac91035b758a24ef11c00

SHA512
1ecb4e0b2162e88b3369d297b84a836aa1dd16f1574b3e25d701805db29158e4c2491f18275c45708d62c451b84e7d0630dec4ecc3b40b7264ca7634844231c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6e91a2aca193cd9580f63320bdbe4e33

SHA1
2a90c07d5d6e5d5c3275da6a62c90d5264d7b6f8

SHA256
5b11b1c5f1f26f1e1d7be0d729d2b54831d53697094b9d9e45a93f9c35615387

SHA512
f73f7a521974c92443c526894da10798a008d8f6e5c38ffdcd504cd1a1244bbc2f3e11c140e066c2abdb477e01f4af53f2c49ce3f390ec6879fb806d1e203c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
226de13d9c9b9fe3e1441f35c9a67f37

SHA1
84abe76d598c9d643b47c6358cefe2eb7bc09dc1

SHA256
450ce5166bb9d307361e210a0c74c4ed89d270093a30d12e17bb7375fa72d3a5

SHA512
e2ec77fbc03c1a2f6177786c720d96c28ccf4f7e44f45ea438bc398e7e7fe00502c80d91eafc0349ee1ffa54ad07b08831889f2fe37b0fdf7ea0add183011543

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit