hxxp://gshgiu bkfgd

Resubmissions

20-07-2023 07:54

230720-jrwpaade94 1

20-07-2023 07:51

230720-jp7zjaeb31 7

Analysis

max time kernel
600s
max time network
441s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2023 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gshgiu bkfgd

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1043950675-1972537973-2972532878-1000\{63A4EC22-DD38-4128-8A82-4AA3037FF422}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
768	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
816	msedge.exe
816	msedge.exe
3048	identity_helper.exe
3048	identity_helper.exe
3904	msedge.exe
3904	msedge.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
768	POWERPNT.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeShutdownPrivilege	768	POWERPNT.EXE
Token: SeCreatePagefilePrivilege	768	POWERPNT.EXE
Token: SeShutdownPrivilege	768	POWERPNT.EXE
Token: SeCreatePagefilePrivilege	768	POWERPNT.EXE
Token: SeDebugPrivilege	4256	taskmgr.exe
Token: SeSystemProfilePrivilege	4256	taskmgr.exe
Token: SeCreateGlobalPrivilege	4256	taskmgr.exe
Token: 33	4256	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4256	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe
4256	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
768	POWERPNT.EXE
768	POWERPNT.EXE
768	POWERPNT.EXE
768	POWERPNT.EXE
768	POWERPNT.EXE
768	POWERPNT.EXE
768	POWERPNT.EXE
768	POWERPNT.EXE
768	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 4800	816	msedge.exe	83
PID 816 wrote to memory of 4800	816	msedge.exe	83
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3680	816	msedge.exe	85
PID 816 wrote to memory of 3132	816	msedge.exe	84
PID 816 wrote to memory of 3132	816	msedge.exe	84
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86
PID 816 wrote to memory of 2204	816	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument "http://gshgiu bkfgd"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cdeb46f8,0x7ff9cdeb4708,0x7ff9cdeb4718
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10795709165958544157,8523179887076102306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x3d8
1⤵
PID:5444

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:768

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
1024KB

MD5
2bf585c64d4f9e34c317ac890782db44

SHA1
c572a988fcafa0823db397f6593de3e0b09a489e

SHA256
dae79ec9511b22fc0f1997c5dc1cf76d0ec750eec1488600db5e55db2419f358

SHA512
c0f4da6a5693f6d81e8a2fad519e3da6a54555385a12b88defe446715c086ce67e75490b25cded345a4810372b5547aeee9d3af28074efb6a7c8f9b22ce66971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
1024KB

MD5
a47e77adfc9a578d2b04b9b0dee0d31f

SHA1
20049d351b008d3d05c0ab68b93586c6206930eb

SHA256
f4694f214232d588f36502980a2a1ee093e37aed03921d6b846aaa1d2a531256

SHA512
c886872dad545a48eb7152e9b88ba568f271230f54987aa0a5d3634b7910ec420ff894820df9f5c2f8553b989f0381cc51d7aecd9152db0472a0a0c10d2fdf8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
1024KB

MD5
77021c56f24e0295f3eb913e044b7dcd

SHA1
59b6768eaae563de56abcf5fa01a3eaef30828d4

SHA256
e0ccf21af95316f721426535664bc22fec6eab7da1bdbb48e17a20ca20b4546f

SHA512
ca16a7217331a6e9a9b4060a7074da66644d5a1ea108fb35cacad0d8407d789131450c650c086a8ab120171a0265e14d13a685b89da0d04ba719fad655859bbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
69837ffe7a35ea8b8279b62bd34834a7

SHA1
5e5107980508c70edbda7f3a320b0379d7d6a119

SHA256
601bec6b412d27cde0f1278f80af7ecb896af93134d50a8774287737f4df5e24

SHA512
22fba3286cc49ee11aa20c01c832126368458712a955f00c7e43fe7da7e157d4eec3f6839b4f1b1d1552f319c0af0ce08433f0f4844bdba911254cc357e09db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cc47c347694cd20482c81a15bdb8f550

SHA1
443db7be2593be39a7a93e8e247757626d41a669

SHA256
a3caada025599a0ff47ac055bcda04c7f42d1e012cfb8e27ac57d01b6adf31b6

SHA512
7ee9c53ddba1f34d4186ba4336c3152763aa759c16f05d39fad5bd5239ba8303576699a21b3ab60fbb1c4aff61a6a82698c1c04d25bdfa2be52f90b62252666c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61032fef09ca40948f8deec950d04cb4

SHA1
67060b247bd7e7f3eabef0e5ff59928b2b5a955c

SHA256
99c8141db4b89be53d13c9f5f40e5551eac1aa5c2ec0fae5400a2008e23fc080

SHA512
bd3de86365a5ff973b06f3fc9ccbd551a215d3a060d6ee759aac3c48578289b9602283c0d9c61e1d64f4192dbf83c347dfbd4f34f2c9ab84a19311da031d0a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30ab43fed342c22c959cf7d7c3e3f044

SHA1
dfee9f93a0079a23215f595140bb574462971f7c

SHA256
d5fcedda942b581ed6d2ee954452471c821f13e48220b777db1884705856b81e

SHA512
5398394b111f6d52aa86a154d834c37a105d48e648a37e299298619229c262015f9e56a415368476b1e4675ac52f890a06e81a0556a6b742693f07d39960acc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f396208026eab720d3b76e68165552ca

SHA1
7a5e944f46835bd2e77a38651e1f658e14b032fc

SHA256
8fae5b4488d6fc817f6170724f6ce8fcd89d85edfd9db1d08b303eeb71a7fd2a

SHA512
85d6322d4a7debd252ec7d37377b2f60940f1b893e5cbdc42e505a281da44db4bf61b66bd9d0e405dd23ab8a91cf881d48dafb1b1233b28704f2fe68e8518788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef48b2a1ca96931dbd7d2e6658f48445

SHA1
2c89fd8840398aaa713e0981b570f8f480b608fc

SHA256
5d6f74a2e1451d0d9c84a4fbc094b0531ab58e963da7f596812abbbe6e2575be

SHA512
d29992ed1499cf5e1fb6c41369527628eadb933de8622c9f7bd8b7d3418fb188f0e542a195d20ab8d488eb69d4405b8be3d5b082af4b821b1acb21daee2f71e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c1721b7291da8370a2a016fa9c8144a1

SHA1
124c315e74e247d3e40074069a9f1142c9847078

SHA256
7e5ea5505920d816fe6045ff025f729ed2e3515c1687ddea278f7c44e42a22ff

SHA512
40730d84de225ffbd58034e836fd59cf681689af7b43af2126f3aea30a7d30b7e6e9a5ed20cee44375470545ddfcf1fc727db62be7ec26b470eff91334828398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
870B

MD5
ae47260067111be09068964fd7812df3

SHA1
95b1433bb92d74f17c7d192ad4bf1ef1a81e87ed

SHA256
b88a7f860253e9f0e8e82337b4fee854378b1e74f802ac375c70f5a5de2287fe

SHA512
070cb02fb69182afc9dba76b3cdcbd8e1bdcb2173fdda427766ef32be95142af63457ac42bdfe23c960aefc7eb6934bdf652aaa7192b9223270bd01dc8971dc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
154626dcbed5ff6c2b6406e275d60ebe

SHA1
11cff31a46375e5e57e67934f304e65640f95df6

SHA256
7498ff29dd7ec9065072550b7271f459bc7bb87b70a80dc62579b2c1cfab0117

SHA512
62f99be26550ddf02180485a51c5a2f36621fd611b37631d251fb0549dcf300d06af1658a5473177187e098ac592da04594f57f7d57921d27b312ba30541dd0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fdb9.TMP

Filesize
702B

MD5
19a3efc0502cbbba3381dd73c8c3f1bb

SHA1
246e843b07cc897659d537ddafc37f9884eb456f

SHA256
164239ddb38f90751434c258a2ebde52af39c22133df43cb28bf4bde7db5803e

SHA512
2d8c04101a55aa0f6a00f863d83d662591e3b789b02fb399f1bcc4b03b0c0a050906429696803bb247047a59efb6c3ec292b99a9e6b18036bcfdc3d053a39319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dc55a552c81b8d6d3af432af35c7a781

SHA1
a3ea06cf00fa0745b9ab3d2ad75f2cab27b60a70

SHA256
13e25791ce7ede6833ab2f9f75a3cdd2587437995a9ff7471b2e841c4f42b286

SHA512
89bedc6d26855364078dbb3b1a455adf06d42d4c118b6643382d2add5f21f7fdddb3e233f208cd2a6d613b93082035ccbf7e0c6d6ca2ee4bb1f40ede6e3992fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dc3bf20259650bef090644bfbd5bcf2a

SHA1
cba1b7ab9a06ebf7dcbf6811e10d3fb4f45f4d42

SHA256
152c344588d6dd54336e3ca8be4d7fef4aa73976c4f9e47b1d53d4b9b0791a2b

SHA512
6edb26953bd8006e62f939f8b20b6c78fec91ea8a1875c23fb333ce82595fd9dcef8876388bcf700c94ee9d25226ddd7580e22b5312cec452279d75900bd32fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7307e2d2cf5f47d116341cb63c9bf725

SHA1
f3d56f985f6cbb03aafd410fe732e68290a2440f

SHA256
90ded0787643404f024903849e9c29e09883306eb90a80c6d755de3299e2b9dd

SHA512
c4c2cff4ea46ea0e1c0bc30f7effa2d005e005b92e249a94a8fb629c9f22ed11dea629baf12da98714b0f3726153072901863872bcc68bf230f75c381d3a69ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/768-670-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-693-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-663-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-664-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-665-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-666-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-662-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-667-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-668-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-669-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-659-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-671-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-672-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-673-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-675-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-674-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-676-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-677-0x00007FF99A0F0000-0x00007FF99A100000-memory.dmp

Filesize
64KB

Download
memory/768-678-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-679-0x00007FF99A0F0000-0x00007FF99A100000-memory.dmp

Filesize
64KB

Download
memory/768-660-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-661-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-694-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-695-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-696-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-699-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-703-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/768-714-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-715-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-716-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-717-0x00007FF99C4F0000-0x00007FF99C500000-memory.dmp

Filesize
64KB

Download
memory/768-718-0x00007FF9DC470000-0x00007FF9DC665000-memory.dmp

Filesize
2.0MB

Download
memory/4256-719-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-720-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-721-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-726-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-725-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-728-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-727-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-729-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-731-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download
memory/4256-730-0x0000012F7E4E0000-0x0000012F7E4E1000-memory.dmp

Filesize
4KB

Download