2b344616d67527a2b67fa9c34ec18b2becd26045e87d34a79e5f9b9e7f09e44e

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

🖨Invoice 10846.htm
Size

2KB
MD5

ec5559b81d5e62b4e3fe8d7a8771f05f
SHA1

83471ee24d3193bb60ee781b9dc63a9e0417e762
SHA256

2b344616d67527a2b67fa9c34ec18b2becd26045e87d34a79e5f9b9e7f09e44e
SHA512

08ba9a153ec1f577712496f4c31f87fb508133f4030c8a4dded617d5f1c1c440fcca039827f35df067513f2d83aa98ea4520928ae72346d1c15c0f5960bf763c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2878490125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31052264"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D6E1DD03-3DDB-11EE-B699-D2D73DF841E5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e70746b52f6804aba4142285479e7a800000000020000000000106600000001000020000000f4cb0bb0f9554d826b3f373bc084f7be4a2d5b5bf0cd5429f32866a461f1e87a000000000e80000000020000200000000fd4ec14fec011c99c604c95d30d0a558d85f82995eef21f5ff8de462a0ea5df20000000920f8f6e36fd122e34193103e20d9549a14f30413fd564c45ab80078260e64d140000000c1f2ef7f9c0455069b425b0d1cbc1c43984fd725d8b6bcee53745c76b267580e890c4e293ae571a5b36ae6a579567cdb09b313d21185d3389c3604d89f8dde4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ee6c9de8d1d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31052264"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2890027639"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399137466"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2878490125"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31052264"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
1464	msedge.exe
1464	msedge.exe
1712	identity_helper.exe
1712	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2556	iexplore.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2248	2556	iexplore.exe	83
PID 2556 wrote to memory of 2248	2556	iexplore.exe	83
PID 2556 wrote to memory of 2248	2556	iexplore.exe	83
PID 1464 wrote to memory of 2208	1464	msedge.exe	94
PID 1464 wrote to memory of 2208	1464	msedge.exe	94
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3080	1464	msedge.exe	95
PID 1464 wrote to memory of 3124	1464	msedge.exe	96
PID 1464 wrote to memory of 3124	1464	msedge.exe	96
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97
PID 1464 wrote to memory of 1372	1464	msedge.exe	97

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\🖨Invoice 10846.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8377d46f8,0x7ff8377d4708,0x7ff8377d4718
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,509956246598469108,13690156565321063482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
300B

MD5
dec6bbe308eb44937f77160a25ee32db

SHA1
8f08a4b641b564b67205e00106ca6bd9ca46fc6e

SHA256
68a71de28f488586c2b169f4652347e0a1fd632d48a6d6725393607bfa18bc7e

SHA512
6c2d684af52588cfd34a682337749b829c2336b34d6add7e8bd6e0c641862c26889617b4d6e9f298fd177b89527deb696c493a205ea8490bb8aee60090a68475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
cc51781ed4bd7da62b70224a52fe7b7b

SHA1
4824a772273eeca304e06371561d3cff6d2adc1b

SHA256
3ae561f0f347b8bca55692cdb44003b9f5ee00928cce18d67541113fabf1f079

SHA512
0645f45cb3baffd8281dd2d2affce58904c40120c9aaab339ff4f01c078c63e15f8a47299515576d6f70c7fc28a931b254c044639983938686525c5e1b3dce8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
fff32241303f52b2c16e88871057f963

SHA1
fda855335c975e5e7b30778787efabe62ea0c125

SHA256
179a0d57914efccb57517bad1abe541d4ce2a1495cae2231f34896f4a246ba3a

SHA512
914ac38cb8c6ca0f65297ce85f970ab3b0a4f024d712338dca0c506239da5317aaf7e596cb171978c89850e5f5efad634547786249963c08f468ec396e9b848a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_A373FEC5204D779A8604E28CC627A508

Filesize
1KB

MD5
ed31f81f7d7364312f450fa1cd268294

SHA1
c2b48bde6d33486e843ce3bf509ff5d6f1544acb

SHA256
97577c56f37a2514bf3d82a40483380382b8810ceeccd96353d548ca732ab766

SHA512
a324eb456c94234e26d1b3456d176d1199283454811f75095af96d7f1ed49b324c680859925a2f97b8839da1ef47c1b71f6301b0ad0657b1de619075f79bf8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
e492f35273aa491fbb9afb72774d92fd

SHA1
44049ce98da4d3effc59f33c87cfd0ab674fafc0

SHA256
6578d6f97ca8d743955fc5743962190e059fe1820dccaf20c95fa35970602b80

SHA512
2def8ab20d9eef76121a3103c543b205ed2820452656393f630f431028656fa3ec3e6a7797cd2b042cc50bb74660ea0cbbe5b88e15bd7716769f35f268f67828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61

Filesize
192B

MD5
173871962ff17a45d0a71be567f9c131

SHA1
82d93fc7999c9d8a77b604c9c2242658621683b2

SHA256
db239d85788477e152ff3e55e025aa0526dd3347b3a5d878466a52fc5a1a3f9d

SHA512
ee021e90f4faaba0ec8ed7472cb79644d5f5a7fc5e377c99f7aa5e55837c432bd81e889fc64efb22000d659efadb668acf83cf93f4a66bee31e4309e8f784e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
8743d6bdb6fdf0586cff4f49d1781e5c

SHA1
85bd57f19087d058f5f549b76c6eb1b9e608a261

SHA256
d9dd9be0f6393db86f77d96fac12e527316c60b4f7f72554da1c44b47867b655

SHA512
9fedd705b48101259a698bf459cc3b525f2025f71fc2fb1cb616ee9cb1ba8a676bd41919eb04389c1cd01ac11b1408de425de6f619128eb517f8ccc12f45dd38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
401aa2bef3464950da5f295f898a78fa

SHA1
607a1b05fd53f32c9b42ac8c0f1cc57cda655e7a

SHA256
8e8ea6e787e3ffa0a8b177980f5aefd7ca6d9d36f2b7c27adf57fa7281a7d0f9

SHA512
2c019b4d260516f4ab536d8e3bac9ad7701bf6d041069e519fd4882869742c916cdfd0772af56b0981b3661c9f7c973bb6b228aee369482370ea27621db0092b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_A373FEC5204D779A8604E28CC627A508

Filesize
518B

MD5
f8693df189901a76cc76e9557379e76b

SHA1
8c0761db195bd8a2046d8f217be69a3c05f7310e

SHA256
1e13249bf9821679ee19295d7f3804a93aee7c7f6489b5074345639f46e24c88

SHA512
aba111f3d01926af19ae379fe529c87c737c9ad1db5692d28d861e7ef7cb66c2ca03e3b3771acf001919685cc3eca3644c2064769425d70a3e5b2447e9fc51d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
43c68fcb151a5e5f37656a91afe03110

SHA1
84b0dd2ed7c0c50f198249e692b012b8e5d926d2

SHA256
7e381d45f45b246ca46068c1097656b3a2cb7b1adb29f65cc5541eaaa1be6270

SHA512
51b869e17e4dd3624af0e8fdbb3920b7828764832c76407443ad0333e03c2d6cca6ccd4f1fa754349c0eedf8576041211b6d2434a21619065e01475477f12009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9b402061125ed11d2b73fba9574205c9

SHA1
86aaecfa5b8899a79899d896172828955ae06554

SHA256
d625d939da756faa5310e7ee7200d47449734e6bc6bd744eb748372d4a2e8dd5

SHA512
5cd2ecf874a371de5f5e708602d972b52eadc4659ed5fff3dd5f3f01ac3f49642a375875e456073ef8f9ffa1fe516e6d87bb6058656ee42e9ed05bce0ff90213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
834B

MD5
4d44abe2bdaad0c280046ebbd5d1d0fc

SHA1
7fbde9c48dc341da99a060361219c1ef6ba25879

SHA256
1d4c99d693d418904ef8fde81320984d65c13647001079d015da9a2668a46736

SHA512
be11f58fd28df02b75ac98afd7640d0b642718b1585cd1cac638eaca9af1fc13f5e4609e2bd0dbe84b3a6ba6f8c98268f63327a5b41d25dea0abae94ad3a59e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b216e97d0e3525334ab44b5d82129d68

SHA1
7a9975cc9870de0862a5f748fce7babdebe745ac

SHA256
5363d7f44360fe88605a8012fa75a14798deae20c5acaa58bd1d6ff0db837064

SHA512
29af57987b6b85d8ba1828ca8a486dc5ead50f2ea9e6ce860153a21072d5fcd52f52575200bb8cc7cde11c74f00020084ecffd8e19a660695392718043deae47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a36b8a76de063bed2ecc4ddf29f48bd0

SHA1
2219da42d206b5eacf87d2ddb4e92332aa40f789

SHA256
297cf465f01e2cfe0eaab0530bb46a62ff6fc61550be520a4ec945b82fe7849b

SHA512
7cd3e1b60ba2bf7d0a89bd6be155fc20cafb912b8c6512e45b0163b0d6c56017000a2e866794e41733b4d9088d586387366b8f67c95c08b19cd1efc153b522f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f43ed117a453466b637f52d8b3bc3dc

SHA1
a75bf6230ed6011bb9feae3302d7e5d23b3656e1

SHA256
5f308206f81f6e067333e03d21bb1f9b3153ee2ea8b46b5c6c26d98903ef80f0

SHA512
98735f8e306d8bbb18d038318d0d242ee67ee4491647edd6b5fa34700de9cfaa510ae2b8b25af1f873a5b452c69b541c43494f425c51a679549b375805115b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7e4273f759a964df7b833f42ca5116b

SHA1
bf4acdf990b42aad8f3ab827f78c2782232ef37d

SHA256
6d5a869310a3d089258cf606c99bbd6a60010da59762088b88f5b4621712a1b1

SHA512
3999489eff12d983b9236da2589c6434b978b8cb773ac8d9c371df64970965fec9064405a58aa6ca7e4f63e1eb544c1175aa19648ea3fd9b0dd5d76e9d890ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5e7e4476af195b6867041e31e442606e

SHA1
734e5bdfa42e2284780d652bc3340f48c0375fa5

SHA256
d18b439ee14b4c34f61415182872172c2402ec625e3f6d3e91c3ade5c35928a9

SHA512
6aaa2e8552cf5da149d508e476b5ef441e460586f8c83d4867cc7220159d19405074f25c954e258cbdf433d81b10a3520eae1ec639669fd3512bafe6778a15c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7T5CRMPS\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit