46fd7fec12ae431d9f9aca1293c06d8d10bb82fc921f44a7f40921ba63bcb7b4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2023 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nice.exe
Size

12KB
MD5

e1ab7e9de0652813a3d1c4500a72c561
SHA1

a5fd98050674055d2e5588f3a088f2ad467333a5
SHA256

46fd7fec12ae431d9f9aca1293c06d8d10bb82fc921f44a7f40921ba63bcb7b4
SHA512

da7fe2cf303ee72a622b6c51078f67119bca590586bb1f298335b3a3820e00ad43918ad5da97ead1eb0cbbd02854e6584e8408d3f6d23898073909171dc150e1
SSDEEP

192:HMDLTxWDf/pd3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	nice.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Control Panel\International\Geo\Nation	nice.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	nice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
852	nice.exe
852	nice.exe
852	nice.exe
852	nice.exe
2348	nice.exe
1288	nice.exe
1288	nice.exe
2348	nice.exe
852	nice.exe
852	nice.exe
2348	nice.exe
2348	nice.exe
1288	nice.exe
1288	nice.exe
1464	nice.exe
1464	nice.exe
4024	nice.exe
852	nice.exe
4024	nice.exe
852	nice.exe
2348	nice.exe
2348	nice.exe
1288	nice.exe
852	nice.exe
1288	nice.exe
852	nice.exe
1464	nice.exe
1464	nice.exe
4024	nice.exe
4024	nice.exe
1288	nice.exe
1288	nice.exe
852	nice.exe
852	nice.exe
2348	nice.exe
2348	nice.exe
4024	nice.exe
4024	nice.exe
1464	nice.exe
1464	nice.exe
2348	nice.exe
2348	nice.exe
852	nice.exe
852	nice.exe
1288	nice.exe
1288	nice.exe
4024	nice.exe
1464	nice.exe
4024	nice.exe
1464	nice.exe
1288	nice.exe
1288	nice.exe
2348	nice.exe
2348	nice.exe
852	nice.exe
852	nice.exe
1288	nice.exe
1288	nice.exe
1464	nice.exe
4024	nice.exe
1464	nice.exe
4024	nice.exe
852	nice.exe
2348	nice.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1284	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	nice.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 852	2400	nice.exe	85
PID 2400 wrote to memory of 852	2400	nice.exe	85
PID 2400 wrote to memory of 852	2400	nice.exe	85
PID 2400 wrote to memory of 1288	2400	nice.exe	86
PID 2400 wrote to memory of 1288	2400	nice.exe	86
PID 2400 wrote to memory of 1288	2400	nice.exe	86
PID 2400 wrote to memory of 2348	2400	nice.exe	87
PID 2400 wrote to memory of 2348	2400	nice.exe	87
PID 2400 wrote to memory of 2348	2400	nice.exe	87
PID 2400 wrote to memory of 4024	2400	nice.exe	88
PID 2400 wrote to memory of 4024	2400	nice.exe	88
PID 2400 wrote to memory of 4024	2400	nice.exe	88
PID 2400 wrote to memory of 1464	2400	nice.exe	89
PID 2400 wrote to memory of 1464	2400	nice.exe	89
PID 2400 wrote to memory of 1464	2400	nice.exe	89
PID 2400 wrote to memory of 4616	2400	nice.exe	90
PID 2400 wrote to memory of 4616	2400	nice.exe	90
PID 2400 wrote to memory of 4616	2400	nice.exe	90
PID 4616 wrote to memory of 1436	4616	nice.exe	92
PID 4616 wrote to memory of 1436	4616	nice.exe	92
PID 4616 wrote to memory of 1436	4616	nice.exe	92
PID 4616 wrote to memory of 4180	4616	nice.exe	96
PID 4616 wrote to memory of 4180	4616	nice.exe	96
PID 4180 wrote to memory of 732	4180	msedge.exe	97
PID 4180 wrote to memory of 732	4180	msedge.exe	97
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98
PID 4180 wrote to memory of 720	4180	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\nice.exe
"C:\Users\Admin\AppData\Local\Temp\nice.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\nice.exe
  "C:\Users\Admin\AppData\Local\Temp\nice.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Users\Admin\AppData\Local\Temp\nice.exe
  "C:\Users\Admin\AppData\Local\Temp\nice.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Users\Admin\AppData\Local\Temp\nice.exe
  "C:\Users\Admin\AppData\Local\Temp\nice.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\nice.exe
  "C:\Users\Admin\AppData\Local\Temp\nice.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Users\Admin\AppData\Local\Temp\nice.exe
  "C:\Users\Admin\AppData\Local\Temp\nice.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\nice.exe
  "C:\Users\Admin\AppData\Local\Temp\nice.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus.exe
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff75a746f8,0x7fff75a74708,0x7fff75a74718
      4⤵
      PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10724496199637970072,16144498525240092444,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+create+your+own+ransomware
    3⤵
    PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7fff75a746f8,0x7fff75a74708,0x7fff75a74718
      4⤵
      PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff75a746f8,0x7fff75a74708,0x7fff75a74718
      4⤵
      PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free
    3⤵
    PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff75a746f8,0x7fff75a74708,0x7fff75a74718
      4⤵
      PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
171KB

MD5
7a88e1edbba1ad7bd345eb14f1377a59

SHA1
b299cf2eacc2d17d1f2fbda9391079b6f05fb022

SHA256
3f6aa29738172f431b8e2af2e39cba0c2f91583d7bc23f988c7b7b35975bef2c

SHA512
48870540a5e7aedf4513610e23dad5d37ff48dde92909345771f7235d4526893e65d11915b46191e62dbe6e9bed4626215703fc90932bdebed356568c1557f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b7cb6deb7a0de93f16866aeeaaac6004

SHA1
5273eb90e25642ba0f06d8dde967a71f729215c4

SHA256
3316cffedc1e9f1dbdb2ec1b02dda2830683150431a08f04fb00f66c9ab87aab

SHA512
704288164adbd8fd1b26509ccf9f9280ebd1d97ecf9f010ff0e679df2a02be0e6f06dbb69b2b6d817f7401bf80eefc9044b270cb6ff32fa5e2ae639015961227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
1e7b2b4ed2e017d31c9c895b3b195273

SHA1
1a89fd10624be5e98d188c9c11b72f133c4fad53

SHA256
286ffee15e0f813a21d6adb46e0fdce53a04c054d8eb1b0dcdfacf4908bce63b

SHA512
fc4a6543f4efb7d07c989e3e67402474fcf9b363d6a96af58ffbd38821e6c0dc2b7f9adbb9766385e0f85c7909b3bca3ccf123b7a01085522571b5e62d155560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
737128213323508c192c2de2da7faf91

SHA1
1237c7231399eb1ebc7224d54a2beb6268f822d4

SHA256
85f9b3ab4f508097ef5186773592131c378f8bd3d41c2c0ee23ed375039fb78c

SHA512
76c9d73501b2e5a5735bf04059afb7afb47461b4dc93ecd0c0e8cd28135daf54dbc067f8aafa6e7c7cea678bf8beada9a7aa42574d3746913f70e21505711024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d8b3099fb607c37fa718ab1f1353d762

SHA1
fbb35ebd403f18cc880ef750eed52788c43bc7c9

SHA256
22028ec3468d0e07676ef61e591a478c5bfd4d3ee008e6242e6cc88ea5b1530b

SHA512
2e34e58641d018b5933570135d30750dd59740653fae9f7c20ecc16d98e8c7dd2060c199dffd18ae00511c8d47fac066ee5de9ad05888e5295f4ca6b372e29de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d86c54a2f2df8921c2da5c216f48841f

SHA1
d92a8a1ad9c83d504946ee56b69e2f3d80162751

SHA256
831b590313cef301baa480ec708b5ea38d63a236f7cb2eea70c076e4259abb07

SHA512
c8d27318570977457a4031aee38b0c17e8bcb3307167ff2e2f31cf3f87e0ad80b91b983b569faf65fa79ee0be6bf41b4b454a349bce2723cda17252282daa9bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0dcca283e7fd639b9c774e2c24479b77

SHA1
004d3be517abff8041ba6cc93c4a233fdef495d1

SHA256
b892dff548e51f18c18f6e5855704b5b79a2183350417528190bf7be1a2ad342

SHA512
16e3df887d862c99ab1061738e5c6c0b10e048afa1fb29eb518583f5596bf76200273777461a36e1f8f602b59214ae82afc0a73cf816304ffef4bfff902f3101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0ffca8f2db365a2b1112a32a42ef662

SHA1
fd23aac1f1f0eb784c6d28fd16aa3fd1b1d9e4e5

SHA256
7ef565c2908617b69a9e07ea2617f153ef244f959e6b31ead15a4fb2728512b0

SHA512
b0bb17ef05f47b88b7e28ddbc00fd578e80a8a7581af6dcf2aae10fe703949b05f6fc4d5912bfd6acd7a5d4fb58b1009bf0512015662d19c407ce0a6754107bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
48cfa01115694498c2fe51c99c827f27

SHA1
f82b523bc097568208f3a6a5d41fc64f1800f961

SHA256
b6c416fe113063bb133d80ccb1c32904a2ca20510489eea7fcfaf64447982712

SHA512
a76efb00ec62b9ee54d8e8bb39d19a91fc0f3c8538251963849fd15f11e5ed6c0b6a71903b2dde09b636eae2e901abc3ea5f6e611184a6fce2b3ec5b2422f695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6a5960a261d7c8ce3790b839ecd6bd2

SHA1
85804215d1a9e9d41a119075f31633327dd192f3

SHA256
e3cf852a8923b76b8de184e73bee8af5c591cc4894ce16bb9f4dd2de2288bb00

SHA512
b27214eaa7cc262ea8b22703c248f0ad99e70fc865ca4fbee7c07a06d8104bdc57d53c34600105336ceb2cafd4595dfdd1c775ea452d1e7c1de7eb762544784d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
aa566253567977ab540e268bab18f74c

SHA1
531efc16eeab4e71981c1f52ba80667948dcf132

SHA256
437d245619b677ab5b4823772729a5094cd4d556e9b6320f01a1940abb44ea6e

SHA512
d3706244601217b46960673df805b4be54b51db51871236bef9f82a760e313366ba2e7ea136b05a6cb5eabea0e4154cffe104286856add6508786a110ac368b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
cd3e308d6e8812df1cc113929fc83be4

SHA1
523ce24ffbc62b74a6a9a010a738a60817785ded

SHA256
f2edffc8ac66075262a13dfc331d615ef01f287ece3149067866e86faa851615

SHA512
bca6ecec60ec369ea518ef9a9d883b1d7e02044cbf8ed2c358cf6ad6aea55acb0056bfa2d15f5c9e31a87767bbcb1a79248de3df66442234ddabd49c9f88c31c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
df97bbe7b5f17912b770135a60410073

SHA1
05924194aeafc4a32b71530b8d10f34773ab6aba

SHA256
4a1674cf09ed2c3e4c2780132a1521421144e10e2c013c50e19eb81fa74f7720

SHA512
90ab2aa5799e7c03e5a2624f8b3fe41c62dd461f9b8fc0eec9e216a876f5a1053f6b4763a41288cbdebbe66f806ddf2d47359e8eda243e5add3b227fbb7bec52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe597788.TMP

Filesize
204B

MD5
b84e476bced40d5449dcc022b488065d

SHA1
becf8efe831a9e04310ab31da262e376a5859921

SHA256
433facebd70b3db33d6ae5c3498550187f6fa1ece44ad41743ae217957d5df2c

SHA512
1e72d7f7669eb936c7af70da49fb79235dcb4550bcb2659fa3ca8da04e71bc18f32d1cb1912eb725bc289e34132c94bd89f836f9135a278299f945ff03962b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7a02f5518444d6a0b4a0d17cff2fd54f

SHA1
714aaf649eeb77130e790f39b0e5556ae7d7df13

SHA256
aa8f91921a18966f673d0c23a80dfb9896d876f2f202559c57ec709a9a32a63c

SHA512
20d912170484b3a379e88ba41e6b7605f7f8e6fbffa5a37ed8c59bd2b273dc12b099a375ca1cf3cf8e7f4cb0281bf011b9097f497823cd801304adeb79d3f713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
15a23e4276e8ea3d161489f29793eacb

SHA1
5d68039626e2517715860e55e67ca52dd5c471ba

SHA256
4e49d980de3a1089502ebff56dbc6c81f3d64ad4f9f32269a9a53bb072661e08

SHA512
d54fd22a28df035aa7f00f48787039814cd19cba1fcb2a978c5a4c4ef480a9ce9c7d1cc296a3a9c2e0ec59b9edff417c30921a3611b983da03842026dec4d91e

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit