Analysis
-
max time kernel
46s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2023 22:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://archive.org/details/the-stanley-parable
Resource
win10v2004-20230703-en
General
-
Target
https://archive.org/details/the-stanley-parable
Malware Config
Signatures
-
Downloads MZ/PE file
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3400 msedge.exe 3400 msedge.exe 864 msedge.exe 864 msedge.exe 4932 identity_helper.exe 4932 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe 864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 864 wrote to memory of 4808 864 msedge.exe 48 PID 864 wrote to memory of 4808 864 msedge.exe 48 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 4144 864 msedge.exe 85 PID 864 wrote to memory of 3400 864 msedge.exe 84 PID 864 wrote to memory of 3400 864 msedge.exe 84 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86 PID 864 wrote to memory of 2504 864 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://archive.org/details/the-stanley-parable1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ffd4e4b46f8,0x7ffd4e4b4708,0x7ffd4e4b47182⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5808 /prefetch:82⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5528 /prefetch:82⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16093150814830224553,4970968677436088920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:4796
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1392
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1688
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53423d7e71b832850019e032730997f69
SHA1bbc91ba3960fb8f7f2d5a190e6585010675d9061
SHA25653770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649
SHA51203d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD56df0fa14a2e2665643c5be5228ba56bd
SHA14441fd2114798c78a224fd9e93187af7c4009ac5
SHA256dc82f5255fd7a09b170a614ce683b522e9c3158f65c0e6b3c011ffa1cd321706
SHA512a174d9806d8b6c03abd21d483c62465f54657167bc5a270d4aec7d4dd62326a0ec7403b71cc2079df79d4630484332a8d6f7945f6911751915a4f53dba6ba272
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD59fff3c86440b324af6a53fd7c5c344ba
SHA1c01705fde6a1d446c584574baf8db6d741db25ad
SHA25645b942d0e14e18309dcf5baa46c746e9ba6a2dc52d7b582bc52ec0f938a8e5b5
SHA512849bd4eb6999f29a6c6c4bc29cdd246d898548a4d35343f59ae486458416b6307860e5e0833022ec9cb9c82060abb7ded3510c4e58f1cd4949abb565ad2acd0c
-
Filesize
5KB
MD554c7519fa73c1035ffbb729fbc74c1d8
SHA1c4e69bcef4a7ad47354f1aa2145529f68db2d228
SHA25617f0fb3513d2d10cf196e6b7b5a2d804b20dbc11214d743f0728110d8fc3b89c
SHA512364b175b22b9184dd9bddffc1685ee998407f0b80cea773abef92304009a6b860b554f6c304c3c4c0b2d7d4a4150623a8aa932851e31a29e8e7319f93832b722
-
Filesize
6KB
MD5944f2107cb7fa409922896767d9d1dd2
SHA18794f5515e058530536bfdb4dc99573ce85bbde6
SHA256c19a96ba3886b8b7c247ccfc944f0b30250ef22c9b0f74fe9ddea9a254ee346e
SHA512ec5eb51be170a9e933bb8b599724c578355833662ee287d6b89c6ff9c0897ff9e12247b103213092b6baf7ed5a2d06e263f6d6b476bb8a1c47ce8a81735137be
-
Filesize
24KB
MD50e78f9a3ece93ae9434c64ea2bff51dc
SHA1a0e4c75fe32417fe2df705987df5817326e1b3b9
SHA2565c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68
SHA5129d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d
-
Filesize
540B
MD5f2478248a820e65470498f22efa7d36d
SHA116290215273375f5ff2f5ef734be6c56ed453e3a
SHA256074fa536866548bf45fe66aeeb8915b96be751299041673f1149336bafd362dc
SHA512166d9bab58a515eb05ed613ce3643f9ff1a2dcff19ebc0f4389f3bd2203a84e4d315a6b069afe71f3bcb04569f8d5b8957944eb448750ddff3ecaccb64d74c04
-
Filesize
372B
MD52a94e1f5b4180a81c74cc7999aaaed05
SHA110b2d897dc5289be3e44199175a4836f9bd6d759
SHA2563a6cb0d5c2d05bedaa8a8a4b38fc2258913bf7096c239bad354d25ba78c75701
SHA5124ff6b157893878cb1bbfd38d4980d326b74f25ae0b7f3b74e5bb42d53f3bfd6b7887e56146d5b5d095ef991b78d27b686ed3b2001d5c890fb9ae11efa2f382ed
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a5dad23516e06be9dfe82294fcab53d7
SHA14e310fc7478b406cc4841c538cecae4bfc9d7e0f
SHA256b2e4b2eccd8ffff814163cab8784161b1d6fba51f3492b3b1fce5d596097e836
SHA512ed76d07a3ecb7470339313c0e4ac41c4f07cce61cf810bc1139ed6a74cfe7a675fe3b19bc2680003dc8213654294163bcb5ff3ecc87fd81c9aaf847cc74c5120
-
Filesize
11KB
MD58c2b12f0e9eedb24c4a484e5fd1d9495
SHA1242f47ecfae94f056278599709501d857faaa801
SHA256b2ebdd4dbce27a1f625f1d5e17761337ab180ffe733e29edda753b314be9f333
SHA51238f47d6fa3c0997ab7e9eb2ca9255102466aea34025198235ecdbd3de91d94d87cab5c325c3b9e8776b6b28f3ab2c2a96c473b591dda7206b7aeccb5a905390a
-
Filesize
11KB
MD5e7771619fd468ca61df599b8b76ee988
SHA1d9b365393436998a0719db436005a3a1de013ee9
SHA256f1ead2b1f8deff7a19571e34108d9f8735910b853dc1d3767cc528ec88f21872
SHA512065159de238333b3898f29ba0da8a52408e235efbc7c5fe0fc6ca781a2c16ca45aca9a6c0d7511c2df27404e6d3227f36888d542a0944bcbe623abc81c4ddb3c