e8a5f5850482d115f6686e1fe206c6ed750e4b5c2ece76b32e9687fca822a11f

Resubmissions

24-07-2023 00:09

230724-afje5shf9x 3

23-07-2023 23:57

230723-3zz68ahf5z 3

Analysis

max time kernel
211s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2023 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Label-495614810.pdf
Size

49KB
MD5

db44eaa51ef5b7dc4c67fd1fb8acacc7
SHA1

4622675c96063b1398bb377aaee796f55f3b714a
SHA256

c332f6af79e59af584f07bca25de782f6d1fe4db2216ec9d4f84ace8c417dc05
SHA512

31e3f286822a226aa17c8d86a149d7e043b0291c42f086120c71e8b05326571548cab057bb7bc98832a19a7dbead8f45f1c2e5fb322a56db9d836a200084e7d9
SSDEEP

768:p+YatFVd/n0WY74IuOyZSvnc7jYqUv5GuSZ5Yow5nKVFz78uFtzw/abRjFM:pitFbn0374I4kvcJUhlSFKKnP5xRjFM

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
4088	msedge.exe
4088	msedge.exe
1748	msedge.exe
1748	msedge.exe
4660	identity_helper.exe
4660	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3952	AcroRd32.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe
3952	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 1820	3952	AcroRd32.exe	89
PID 3952 wrote to memory of 1820	3952	AcroRd32.exe	89
PID 3952 wrote to memory of 1820	3952	AcroRd32.exe	89
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2796	1820	RdrCEF.exe	91
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92
PID 1820 wrote to memory of 2312	1820	RdrCEF.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Label-495614810.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5EA38EC95484C2481E0FAA02670EB3E5 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2796
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E18F34D2CC4FAC2BAD33DA5C8792E86E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E18F34D2CC4FAC2BAD33DA5C8792E86E --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F84AEE42981081F7EF5FA1201DA46D7E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F84AEE42981081F7EF5FA1201DA46D7E --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2E00B831F7A041D47A6157518A584B60 --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3F3A459F704F9F6C13F7DB13076D3524 --mojo-platform-channel-handle=2116 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1816
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1F38FE3A9C6C071AF05916C9B06EBA25 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://inpost.co.uk/tracking/?utm_source=zigzag&utm_medium=email&utm_campaign=thank_you
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdde246f8,0x7ffcdde24708,0x7ffcdde24718
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10133493987717641831,17015825709244065011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
    3⤵
    PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://inpost.co.uk/lockers/?utm_source=zigzag&utm_medium=email&utm_campaign=thank_you
  2⤵
  PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdde246f8,0x7ffcdde24708,0x7ffcdde24718
    3⤵
    PID:5608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a2dae20bd5defd20715dca1336e3c3ed

SHA1
8b88ce25be12c255af8da7aa8cf4a4cd2ee5ad0a

SHA256
fe095c35da6e321b6f6e696c2ece1c8b2ff26e4806c8b08bdc92af9030393e72

SHA512
529d4741b115db57ca149c21712c07dee5f27a1fb50860c30bfda7bd80c9b98dd31d89410f8375a759be4d4a74f787850367c3c94b66d367d4a6cc233a8d39a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
45c70360d52a750f87c2260f65a1893d

SHA1
867ade23401bc7befbe383590d314cd945002e33

SHA256
844973114a2259557d6c3b2c984a79cbe51a69243dfd02a912b88265ab3d7539

SHA512
9e687b044deaacaaffbe625217dc611045ab1637d2071c2052128d1aa52b767545f300e48aa2df6c6782e846262be363f46379241c25dda0cada9ba4b0dc9de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
795a15d6eeea661cf51cbb57b4df584b

SHA1
5ab9cdccacb9e5dd4d7df25c4fd5788f8068b0b3

SHA256
a16bd2a4e24959fc64a8d6d6928414143a4a6a3085cd1c17a9ff1f1a826efbc8

SHA512
e337adeb8b21f9c376afc000aba5b1e0107b4cdfb7cd0425fb070a4447e69d600700a5e481d751804d9fbac2737851e8e134591393a5522434087cc55c742554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
44KB

MD5
b9b7efef2eecd64835af687858cfc444

SHA1
406c3a176ab10182e2f204144fef4cd665ee32f5

SHA256
d28e677f4c721bdaff03019504447ced92d204a6271da745f5cf6f4390c3fed0

SHA512
2a8682997e199c7649874e0537ee0eaa6d9aa5a1777bb4ca9e1a346199c64c7fa3e594c449f11a4c16aee3c29e8f87fdece87a7cc2baee8f81a074d840892ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
18KB

MD5
963a030e56de5dd166f832c69a7996b5

SHA1
3fe76ea63b96edc0e24129a869ba03e352460033

SHA256
cc62333b5350eb8b4156dfb99db4ef1eccc01f7601859fa1b2e379908e5b6ab9

SHA512
9d5ece48113be304c3732fc24918996b4238055ab3267c3d94e6195d838031a0fd6d35da654605a6bb671cf48f9f7765f2b33f83ef805f0f5e9e67687dfea9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
a4061b941ec052d431de6ede038fd350

SHA1
fed6e8de97eec4d3cf6e150dfaaf417ebff6e07d

SHA256
497e676df34b138564b7ad613720d7355fb905e5a156e618fe347435486aa01f

SHA512
0f644355c36d5c35782c8e63c7898e72fcf9c3d9923ddae0a3f1dfa714e6d7d81a57272ee805994de5f3be741ca03769e006c1713e9f4566064b8496da051980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
53f3bf8815a8692d8bcbeacc4a9bd055

SHA1
a12dc9e778c8b7c72fa89d318713b3c13757139d

SHA256
9dd1747e6084a06c668b8b358ecf477f98a7ef5e88a3bad172a9b8f66fc77750

SHA512
66516bb959e4141fb9555734ecb456e3bc73ced6657c8164fd15b82a3b2876278e98800ae0f657513063b3760f7ce0cd617145f26f3b8a6eccfe0866563f57f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6ddf7b62f237bd0857d4852514accfec

SHA1
698f166021d926f55ec52c2184f62401630cf168

SHA256
a2cf2dee699faf6ae491c56fcce880d2b7f5613b2df963a21ca2dcac834a1c5a

SHA512
29ec9a63db426ae68484a792d39c0c43080ea64f3a102d32ae53e5c948004f39ff93021f6891eae5f9f34b74bd459859488812a040a773a321443d11cb27042a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b90a5ef2ec777e1205f309c16ec0ab18

SHA1
4540d4b99a62a85417b6bf0dad5606886d4415d4

SHA256
c151dcc705912842b1c94fd975c679c3b590fe44503289a8621ff3f2f245ceca

SHA512
fb839e7ac4b1f90cefe67393c2137329be509b91490c8ba1a7da6c61f29d98b287c86840179efdc5b1ad1b35ece83485f7cd3697a044a38e6c9edee7ce7c2d97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2baa7919f83ffb5e9d6f5fcc38b5be2

SHA1
56d8bb02acaa26fdf6b0cafdaf1bff7b1172e022

SHA256
bb079e962bcbf14aa4bb391673de9e465406866ad00cb14ab907b5e7b752f77c

SHA512
c3198ac79b436c867748460bb772580cadea4722eab56ca1a35a05865fc0f17cafdf11247d9e9ed72fa58674842b3d330472e35627812f56cad78a53b8a2dc88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c2c298ebdc6106ad21351a889dd3ed0a

SHA1
bd5189590da6052070bfc19de22b9718580fec1a

SHA256
0a47b5f5aaf4fd918aed04c8b8b15a6aca54eb20699e4834f846bcdc48141574

SHA512
c33f540d24b9cbcb978a2f23c1adbedd4699fea15ff64a21f6425a10eeebfaee78b9ccc9a3f0c4c77aa284de6fbbfea06f96007e03dcb0722de886767578777a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0ee86214896a3dc51b8e5822c3203b6b

SHA1
81f4abb2777f9340889f3e8cd41a2636a58a6778

SHA256
2d4b02a8bcd2b1a912f727cc6920dbdcf4d03a02ba65004f7808bdd1fcc80250

SHA512
c1a8c7601b2c72b737318de6f3b8caab554de4f09420723c62c4844641eb5b8d08e33162c8973206991db192f560fb524d5e32e6436d37f4e18b91934a76cba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a0f15.TMP

Filesize
539B

MD5
7583ad11237342932c01a7d62597112f

SHA1
f5b97d549da880c24ccc215270d9e88c654b8e41

SHA256
ec577fcb085e4354f4b62b79699d94bf60538101300b8f4faba19fcee4c52257

SHA512
4e7ef6602de564c9040a0c97e970dc341819918d866063db0040b1806451d5c013362a5a3ce2e10adf63498366b7b3782dd83766bd0101d58c10af8be8e55036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e8b5a0c3d20d8860c05d7c9e8f3334a7

SHA1
e5996014f2f422400f295eb7cabfbb6fac550b6d

SHA256
747d7d0a502185d6ae47d78c7564078fb8860c919893192599893ebdb5fc7a48

SHA512
a3c7ce12b68d4a38fc506056e4f961ede30c1322b7c1117f0cf4fc7135c1f22089c94b2ad998c70e5d17295d982ce89b4460f87145acda68f346f5eb8fdcfb8b

Download Submit