hxxps://github[.]com/disepi/ambrosial/releases/download/1[.]5/Ambrosial[.]exe

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/disepi/ambrosial/releases/download/1.5/Ambrosial.exe

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230614235713.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3d3742e3-417b-48d9-9320-326bb524af08.tmp	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 861a78379e45d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{0CF87DF9-FC73-46DF-A8AF-AD25F068DE6A}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{21F41E7B-0B0F-11EE-9156-5A0CB913B9C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
508	msedge.exe
508	msedge.exe
4436	msedge.exe
4436	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

msedge.exe

pid	process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exemsedge.exe

pid process

2004 iexplore.exe
2004 iexplore.exe
4436 msedge.exe
4436 msedge.exe
4436 msedge.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2004 iexplore.exe
2004 iexplore.exe
3868 IEXPLORE.EXE
3868 IEXPLORE.EXE

pid	process
2004	iexplore.exe
2004	iexplore.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

pid	process
2004	iexplore.exe
2004	iexplore.exe
3868	IEXPLORE.EXE
3868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exemsedge.exe

description	pid	process	target process
PID 2004 wrote to memory of 3868	2004	iexplore.exe	IEXPLORE.EXE
PID 2004 wrote to memory of 3868	2004	iexplore.exe	IEXPLORE.EXE
PID 2004 wrote to memory of 3868	2004	iexplore.exe	IEXPLORE.EXE
PID 4436 wrote to memory of 4532	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4532	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 3436	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 508	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 508	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe
PID 4436 wrote to memory of 4356	4436	msedge.exe	msedge.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/disepi/ambrosial/releases/download/1.5/Ambrosial.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc8ffa46f8,0x7ffc8ffa4708,0x7ffc8ffa4718
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff701305460,0x7ff701305470,0x7ff701305480
    3⤵
    PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,426207467917559966,6135397619987039743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1796

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2c65ccf1085f2a624551421576a3ee

SHA1
f1dea6ccfbd7803cc4489b9260758b8ad053e08e

SHA256
49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

SHA512
3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c3770be634be8da92e71a3f9f76d79d3

SHA1
f4538b79d313dd46e55d1fd3e6ca3d4681fe4c3f

SHA256
23549094c00feed7abf21e56caae3c8b22a7bd89cfc2f5ea369cf13259273432

SHA512
09c1a087be6dcb49fd0725936571946266f31298f8ae141d59b9ac60f3f0fe8e7d964f661818d72682633845b48dbb906d8c89bb33bd2060bb4971b3e14fc4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
6f3a21fb4c0c9ba54e8cc6622f1e9668

SHA1
a062914965b33e63244041434a5265acf7b50443

SHA256
36d6ab258686b37ea3d9e881d1e340d0b9479c9e8be056eb390f34d8522dca10

SHA512
c9213ca00cc68b9d66b3f9f1b8095df991356496983bf8ab0bd1d454426e14944adf3fe98bfdf082b9ff0af91c6d251866041af331770c84eb0050895b9489af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6727d09cfd13fe6ab52be3849e62f8b4

SHA1
9c671a92fdd92367737c92a4e95e2f0841ff2edd

SHA256
5519fd645a67539afaed51d45d1cab2b5d04794f2470e5ef4bebde2ba7b2f10e

SHA512
2c2097e00e614219185bc22b0df4dfb77bcd8f905c7195260c7216e554061ec4417de7f3b45b3ed2e333f1932c96e0bd559f64246eaf9c0bc8325cc8df053d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
854c0eaca06b107d1e8d33df29d4aed5

SHA1
66dd6e25bf7a5f983dca1ca275c9d1b9854c3bf4

SHA256
abc5e3dd00042b8f7137c7bab9e2cc0bb8d4318b885dfb5f6fda2dd4d66cca44

SHA512
6ee220633035cf0e3045bf172aeb00c467cd1b37b4ed4f995d4051b5f62c4290acca0fb76c1c376946338b04182ea181a3fa6ed41af812687bbcc2746fe31536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
396B

MD5
836da9d09f7b43127fafef59e0c2e7c7

SHA1
8518d101c7c82ef38c977101bec65b7724d9c08a

SHA256
51a808c834d00bdc91ffb56945c301851b0bd073bef016431e490fc628aa71f3

SHA512
fd541ebf3f9bebf38e7836a468649e8fc01c8148f43508337e98e2ab00bb33b5b9e925b4ab7e42bf18c9f9788afcfae3c712b683c5cecf53b5db3b42d6887d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb8881a498856afa338e2a5d48bd6b51

SHA1
53424984f9c1041b69520dd5e4c1e6b0abce708f

SHA256
33ff6f2582fadc1c341f5c3103779d2839ed3212ee10522c1df6a6e6e1e2e694

SHA512
18ae9fcd678b7a2b08a6d17ae35e99c3f1e17d0afb31983189de2790302fb30124dc83510253bfcb93d4c18851035cef3873a1ddde2f33353f0571de27cefea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
29d4091cc722e0c0e20697a6c3501961

SHA1
8d85a80764d0d08b01d83c5429aad5ad8ab6c320

SHA256
7f6609f1570420e8020edd10c18c282b4443f525ff997e362a13734c00760b1d

SHA512
b0a9200e4ec3a11187f5df49b0e8dad28a595d892e33cbff7cc35dc1c99d93ef1abf89073e0e24bcc26ba4a483a93bf6f4e113fe571ca0579213172a980d889a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d125e1812dc7ba9b80b9769a518fc63a

SHA1
a67fb17f0d3f6a6c4829a9d5c726b82ca02bb54f

SHA256
7cc6f840a7889fa2cbaddffe15bffc68f952831149230e50035221be9b4b1e2f

SHA512
6672766847eb9468ffbc0fb80e1885f94f9146677525881ce95c966952a48bd23ba5032923c5341b4abcf031582819b06385308bad70fece2369535deb06d85e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
cfd585ce0db9a1484f8223dc2cfce2f8

SHA1
4e5e287160c05ecdff8acdfa0899faa5bad4de82

SHA256
0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

SHA512
b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b3fbb8a02260d5e41407a7e1af3ee2f6

SHA1
9180c8b9593405936b0fe52272571b63829525d4

SHA256
8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

SHA512
8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
96df35075823d1ee2007088ed795fb25

SHA1
bdbddbdff9fb0aa875b72e1a518b54938bc6fb80

SHA256
2433bfedfcd5193b15d572dde6d0b970f7800ad9b9cea947c359df86bcae4739

SHA512
b9aa1c29104804404f055ab8c375d2b70aa54710f9b59a41f9a7787e4e88c0bd8c2ca80d92241e31c3dc3316a7c1eb19df5b7272a4f62e6a9e441860ca0e3393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
6d9ad49057753b679c398e76c70c29d3

SHA1
44e1b15ed60e2daf0f86e42a93528fecabb28f47

SHA256
b45c5ee4e9f9c1cdc3f8d7038678a6580fc4fbb05f358dded1f6c4be4152d816

SHA512
eb4ac9aec8c11aa26381e3acf297c7ed8e7df1144079dae52e7830742afe28aa4aa600bbd0e178991587ac0e850e9c154eb17d758c66cc1da0852ccec84ca99d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
e1234928c61ebfd53828589b22b0ebfa

SHA1
70c244ddbd4ad4bd6d81441df0ab32b17e1d027b

SHA256
47f38f484672e47760340da7255a5dc733ea86b45e4c31ef98e7c38bfa00dd09

SHA512
420049fff66a8309a4db41b62a847c270fdffcb994d7654b239c53dddc72d7060f28eefc5fc8d6d4376ed09295313b6f2b78ee15dc3c8a1b0b709f2b44b8fbc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
b56b4da34287d5e6e2cf3eb171a6c4e0

SHA1
4e468570db41a3259dbf5f56a8c49b102d77a9e1

SHA256
36f36e5a6d6d917a226ad23dce6c41f4d1f6e58da6b3fc1803cb07d972865fdf

SHA512
ec5b4530d660d62522bd735aed77dc57059b995d09cba7597095f9b8a5978b5726cdf1dd133e4cef06adc74a50c07b5a8a2bf1380630a524798022dcb53c0a13

Download Submit
\??\pipe\LOCAL\crashpad_4436_ZCBHJRXMXELJOCLS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit