hxxps://github[.]com/Pyran1/MalwareDatabase/archive/refs/heads/master[.]zip

Resubmissions

24-07-2023 08:36

230724-khjtsscc8x 4

24-07-2023 07:58

230724-jttmpsbf29 10

Analysis

max time kernel
1800s
max time network
1694s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2023 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Pyran1/MalwareDatabase/archive/refs/heads/master.zip

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1043950675-1972537973-2972532878-1000\{4EDD4FF4-D352-42B0-970F-30EEE2B2EDE3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
208	msedge.exe
208	msedge.exe
3616	identity_helper.exe
3616	identity_helper.exe
2796	msedge.exe
2796	msedge.exe
1556	msedge.exe
1556	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1536	javaw.exe
2376	javaw.exe
1536	javaw.exe
2376	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 3324	208	msedge.exe	24
PID 208 wrote to memory of 3324	208	msedge.exe	24
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 724	208	msedge.exe	85
PID 208 wrote to memory of 4044	208	msedge.exe	84
PID 208 wrote to memory of 4044	208	msedge.exe	84
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86
PID 208 wrote to memory of 4656	208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Pyran1/MalwareDatabase/archive/refs/heads/master.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacdb246f8,0x7ffacdb24708,0x7ffacdb24718
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\hello.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2376
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\hello.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,3928414939915977692,10116686258800796263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
50c608a59cd5fa9734f4985a0b636397

SHA1
624c4b11ba9f58a82e758b3167680c650ea4d60f

SHA256
1f6cb744cccc3b7a24532c777f40308d1288cd66f2ed1a63b2d120ae008db3b6

SHA512
f0dd125f1047a6a5da0d705087ff3dd27207590e68b70c07d1ae7aca3bbf4ef7c86e8b07fdb483b504fd39404f01737e20e949fde5c9c4de89d18104aad76bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
16225ba37ec32953c3c7df44d2113b4d

SHA1
5a59abd67d18c763670586bb6176095817e3815e

SHA256
16a80b0eebda3bc44883d4ed5de10e5c20a3794391ba3fe72a24fefd7fe50e70

SHA512
5ee1dd06602f288b4fecc78f6e5bb1338bc3ce99c03146ae59e955a0ea0c431fe3492a8c3d22bcc5379519209e81fc79b701b86f0788cd69356deb5aca52b1b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
694B

MD5
482563035ecc6db076a8ff22ecd26fdf

SHA1
7165ded71d6dc57728de9b5724991b496b3f8358

SHA256
3df603311c8d0fa4c8944e3ad91b0ce2530e75af976a617c259ca03370a370dd

SHA512
30bff76cc6f8b6da1072440a963e934ac0945d54ee87f85cf02aa463a1081fe3b1585f2d78036b51917c6e763e7481f94f98598467e11eb77744b3e9f14449eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
543B

MD5
ed5083ed86d4d79ce77f44598319ed06

SHA1
56871f64d8529acdd7eba151e502555f54211024

SHA256
6d5573bd14ec66f5e0b34e05e96512d02deb893776513a0931bd5295a0095171

SHA512
4c80c8e9d59930fc2fb08f94a3bccb097109d827d44b78cc34ee68d7d0c96f820b4730dba4d0b17a3d3227791fcdea7481d0df5073480c460e744d336ad4c0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cf8ad19795a881480a26e75e4ec992a1

SHA1
4f05ac88b1dce6ba427c9247475f76c21a4999d6

SHA256
1b17312fde9e8a85cf5a4897c769074719e029ec4666045878194bd347af6a89

SHA512
1133b246ba2920ff1d7f3d6e3a385a14260f30d73a307e4fcb72cbf2ee7816b8a2b3d40694643d53403958ed82c6f98f349d4bfc143cc85a468cc52fe50b5184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2bd44c6ce3d73b05fd6f7f7c64f926b

SHA1
be6fd35b38e4fac010df206089190b0c74b94f80

SHA256
9c05be615f285323b582ca4c5369209eaffd921c37ef4f11a63b54a113b41fb1

SHA512
58baffaaab2f415b94ec1d3f1fd126fb9bc7a165b006192d45e823cfb3810fd2cea8114cae9d751e0baea350c8f19ee282e954e1d1cefc1fe42f205b9cea48a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd0019ca0fec85e7d563e7fa2b8ff522

SHA1
69651d73ab6d087d057fe58f2a6e741ac4fe1f35

SHA256
6c8286b5bc512a20fc07723f60981c09f69f4546874387c1f5b9edde1eb14900

SHA512
83147473361414319371cbc253776584556f5d231bc10a9d9658f0a23d79a0833ec26afbc67128367ad8c115a2cbbc3f115ebbbb21faf586bb0603fad4648f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
444f109a9fe54295fe010a53d5c053fa

SHA1
d457579c8ed4d4c1fc15c5bd5d159ad1c9b6b7b0

SHA256
f0ccf375a11119782ce24e01b3bb47a2f6caee771fe514b031e9565793824793

SHA512
413891005a8b6b2f2427b42583d47cf2c279a186279068513db3318bcb5330af478a2e4355cc80bbc5be59927a9baef4b713e0a14b4e454d31349db64da15a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
948288457c1c4b1721b9bc921ade31f3

SHA1
ae03a103d76ee8ac7be3c62d5da0b3f46f9bfe3c

SHA256
bfefcc390060437fb3f3df19efac7f90a57813d42e4e0f3b62362efed2727434

SHA512
4f34c2147a4dfb3f0c69795c525f249e21a5c6409ccb3c6ac289bb377944ba228713502fd9b058120b173d720244b11e02d5882dc1e6a982a484c1a20eebf425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
0dd9f620f5c98a0e7720e08b17c9109c

SHA1
ecd1dede5be09127ebde2aac07e821c5484f6a73

SHA256
9997c9ce0c8c3eaceaa0999532498dc63dec470b2faad1355471f8f20d28605e

SHA512
7d26eb33df20df8d9e01ca777188ccbe5045271cdad7b8da8c80b3f8e502dbc78db18b6c6f1898725b6bfda356ad193f48517e9e53cdbbdfffc97f233ab4bf27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583eba.TMP

Filesize
371B

MD5
fd18530c21937b6b45e63e59e7490a81

SHA1
4257db72bb3d29d70fa7fdb39de4f00eae050252

SHA256
d020c9e937659aa0574de9e3cd602f11e8bc02c7c87a23429042ab46b3a2a18b

SHA512
bb0740774b4aca27288d8c7d788114b8c63191f38ac16f7afd2e9d3b94e25f1194aaa04240b3e9cd986626ea2caddb13238061b82e1c17ff54a5e5793886b0bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
0f4dccc03a8edac6699a87236c8f2869

SHA1
ec1c0dc6e88e5efc6d481612843579d133a119a3

SHA256
7b0711971a9c4a516199423194ac17cd9f0801f2a72441b3c2a033bc3170f15f

SHA512
6f3fb1251f15d940c19fce4efcb3522b15af4897d434ea0f038e40d48f7dca289014a95004188217b095a6f100adcb7968deb801f5e213a4784c06fe5e9c746d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2b1300040b1de14ab9019d9b3054b421

SHA1
7b695db76d7769370e06b92adb6c3146792a85ac

SHA256
a26ab8119a13fee884a5feb5eb2a3a2de17289c6847afcc1750532f97561ab8b

SHA512
b5c6a44b149e634238b83519c0ebbf271df2f9cfe55ad02c23a536d4336cf42511d82fe5905cd18f797e5707d7acb200a46ae7e5f89f921478dc9db5528a809f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
3042a54e5d8335c16a5c171d92f49cbd

SHA1
59ea12651cd3c730ec1d7c0b3fe2f55048a56138

SHA256
a75b1e8f9f9a46a5974af695d76dc4bb00526f5eab3ef87664bda2bb4a9a8e19

SHA512
1dabc8920fc47d1072d134e3ac4f3e4daed7221ec2313df6fd22e02f39c3eba125e0652d3fcb20177568f79e520157888002314bb57b3e1a0bf660e614cfa6d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5f0648e-8079-48b2-8cc5-07b3d77ddc1c.tmp

Filesize
13KB

MD5
d6a68dc6bba9a39fddef6233f20ab6bc

SHA1
fa8d69a2f91354b10ac807496ea1df4fc80f10b1

SHA256
9dce821e9e4d8f74c15a854b8b8ffb0a775ea40185f3d6920d9453217e551790

SHA512
3cf4922bf590c44da9d0cc5f40b672e9587dd304f4cbc62abd2f27e1557c60c6081900182f6903b9f5a649ce5cc2822232c74c9e25fb29bf848a979778efc4ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\hello.jar

Filesize
1KB

MD5
cced6d4d19219bb3892427cbc61001ed

SHA1
e438d9a4ed24f27117a649021f26b983d5fc219d

SHA256
8e46f478cc3fd50a5afc3bd99ddb32c94c4986c0c84101ca3eb92008afa100b3

SHA512
56bdbcc766dd1af9ed62810bddca263a65c4ed4761422f2ebeb0b0225248d3d167af54190066b9f718b6f400764d2dfd0c8413b57db5dd3f6c5a5445bf1970f6

Download Submit
C:\Users\Admin\Downloads\hello.jar

Filesize
1KB

MD5
cced6d4d19219bb3892427cbc61001ed

SHA1
e438d9a4ed24f27117a649021f26b983d5fc219d

SHA256
8e46f478cc3fd50a5afc3bd99ddb32c94c4986c0c84101ca3eb92008afa100b3

SHA512
56bdbcc766dd1af9ed62810bddca263a65c4ed4761422f2ebeb0b0225248d3d167af54190066b9f718b6f400764d2dfd0c8413b57db5dd3f6c5a5445bf1970f6

Download Submit
memory/1536-581-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-612-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-558-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-562-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-661-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-660-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-630-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-616-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1536-597-0x0000000002BE0000-0x0000000003BE0000-memory.dmp

Filesize
16.0MB

Download
memory/2376-484-0x0000000002DC0000-0x0000000003DC0000-memory.dmp

Filesize
16.0MB

Download
memory/2376-585-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2376-619-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2376-620-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2376-624-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2376-582-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2376-523-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2376-504-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2376-669-0x0000000002DC0000-0x0000000003DC0000-memory.dmp

Filesize
16.0MB

Download