hxxps://www[.]dropbox[.]com/scl/fi/we1zqq0uwd2xuyp844m8j/%C2%A1Un-nuevo-archivo-compartido-para-revisi%C3%B3n![.]paper?dl=0&rlkey=0qc43um4v2gwfa3rb5ekg4ilb

Analysis

max time kernel
205s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/we1zqq0uwd2xuyp844m8j/%C2%A1Un-nuevo-archivo-compartido-para-revisi%C3%B3n!.paper?dl=0&rlkey=0qc43um4v2gwfa3rb5ekg4ilb

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4078585466-1563564224-3678410669-1000\{DCC2E164-1A66-46CE-8129-550307CEDBF9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
4920	msedge.exe
4920	msedge.exe
3656	identity_helper.exe
3656	identity_helper.exe
1124	msedge.exe
1124	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 1764	4920	msedge.exe	31
PID 4920 wrote to memory of 1764	4920	msedge.exe	31
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3056	4920	msedge.exe	83
PID 4920 wrote to memory of 3152	4920	msedge.exe	84
PID 4920 wrote to memory of 3152	4920	msedge.exe	84
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85
PID 4920 wrote to memory of 4396	4920	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/scl/fi/we1zqq0uwd2xuyp844m8j/%C2%A1Un-nuevo-archivo-compartido-para-revisi%C3%B3n!.paper?dl=0&rlkey=0qc43um4v2gwfa3rb5ekg4ilb
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3e6346f8,0x7ffb3e634708,0x7ffb3e634718
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3222216895713531151,14268361897471546677,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
048656f46cbeec431fc9211b492b0210

SHA1
472e28d665f77507f42fd6d4373d69efe4817fb6

SHA256
b70bedb089a51bc48a6d94fdc9a44db7310d8ab1d5f17c0592e438a42efff050

SHA512
ab8a2e36fb6fa2afb017f26c1e15249f4d76ae7fef0a5c6142d50b11072242d2fc74bec1ee0c7973a4ec3b3109c3e26a7b48b778343208644dcf806b74572c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0413469012bb720fc678b6273a0d52c5

SHA1
866d1ecdee7f4e62d1c92e095f855bcde8bcdcb7

SHA256
2449c86c80943cbea910c8c37a6357474cbc677eaf7fde724d18f054c5a7ca52

SHA512
9d5664778fdb38821dbc4bf02e23fa3d6edb94eb0a172edc20916b442a3363e1105bb4ef44d62ebaeae3fdfd0b87353dfaea9273578e28547b0cb3f1ce0cabdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8eb7f5db8a3b4c0131186c7165c3f4ee

SHA1
c542189a3c64170f23bd2ba3354cafe619ee2cea

SHA256
40fd6dc6596a3e72b18da8a5571b149c528faf4ecaee38f6e649ee59fd579efd

SHA512
387b2eaf31c1c33f5d0d95c1ba3571e28782ecf7d77e828e83e23bf3808327e2f8995bd3e74574af67c1ce5aed79487306a98de5ec3830aeaa382f7b3281fd9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e6aff3a0433e4168c468b698411fe67

SHA1
b11f55f39b56a925b80dccb6c65d877614d048f1

SHA256
6803c02ed06eb09f55d68a6d356663077a2a90ad1489d850fd89677c7f9a52a5

SHA512
cfcef3451c0fe3e2f1c232be4f866ed5fb07db8abae8b4bebb8fb386bf9267b3f201986aafb4bf1d787a789e2d50e7cbab25e2d70adf7f747fdc1b92ce060afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d7c94e85b5df13f07f6df2952676530

SHA1
29969f2c83167c08af690b24faa75f30cb992814

SHA256
c6395f9f688fda58d72446eeed90fb75fe6f7cc8bca5b3f6f8f21850ac8b7e4e

SHA512
371e178a26662ea056b2f21515c0ec31522ee73e0610f793b25fe3e1e0bfd56e598641bbb73d1453b59c692dfba5a4e56d2ed6c5c1f8f8b215ec409b71fc4fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14bd051cf83ea5aeacb92794b72a7ce0

SHA1
8285c04754e786016226dee35d436cad2eddc153

SHA256
8cb9dac0f269ddca248435721be11569785c33ec775ce9af78cd0bc92df8debd

SHA512
be304c37a22a54e0dc0966040ac29b90f54f630452f41f75d83a69c11c6227f9b690156a3d8a546ff90b163e6683b05479aeba16c4fa459638c81e3a35283453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
452104336dd1e6dcac31dd8d659f3ba0

SHA1
116ef3df286dca6a5ba393c457aae9f5c0ee5188

SHA256
b3fe6b807350de22386300f97759c1a122d7819c16686b3d0fb55090158ca495

SHA512
7e3d65058770d0ca4ddc2d5988edea579841644f4c84a1ffe131e658e1d1c253b701f209fb0c24a66cc4257374e08f1512d19ae7fe673ba2a39638553a009f56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3575c87dc6013ff6b4766e0e6f2366a0

SHA1
237fba5a2e6a584a84b824582f8e27dd82d67d10

SHA256
17b35f0e86eb5955edd09fdf5d5100229d53ec9f36fbca487c4f4f9b3bc28749

SHA512
652a4ae0dc8ad39ad0191f676fabde9249baec9e63fd05ace57cb627fd66865d584783dccfbb966e90e8acbee53e8413e925f66652b07d9c57edd321c7bc2db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9623fdb1617bbd0b3eca57bf3150302

SHA1
f30bbfd1039c96d0896bb72037159e02ef03af40

SHA256
575949f74d51aa4af401636ccd4c70df986c9c743d56b6b7ac01d89e124012e5

SHA512
132b6e8f23429dc62e35faa53159430087d26ea02a45ca766286e8b5a5ac681815515a6400c8bb5061e9e8b2141627236e2601916877311ca05f1e3b256e97b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b2cf4d0049ace39b74eef79a55294004

SHA1
d7c3ca52a379d2e60352e30270360f961bbb2ec0

SHA256
f09ecec25a5a6280529f91f243579b90dff160b1432b685455031fd1dc4c4f6f

SHA512
75dbba4e152552da37f9f7b5b8655c7034c070db3bdbc3c4ec20bc5e509c420df86f6f5ef0126ca21b3eb73fee1ca93d1b555896a51a95e806655de491dcbc16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c67fe92b2047eb6951e5bd826cad5af

SHA1
46d182653261f6fcde99dbb8c12ac81144524917

SHA256
137c59f90416771639cf8f0c0373e5ff15e9aae1bb4d6dde4e2a4d68f995e8d2

SHA512
8774574b41058bf4dcc57c5994815cb167a1718ffbd800693eee2cd0360181b3572eff5d4e8ebebbb23a017940eda67781514cc6026f0786312745d719b22285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
141d7f94115d9b83cf6d7de34b52408b

SHA1
53e1c77f4bb4395ccf904569becebc0e92b890fd

SHA256
21d9c38840d47e332fa4e10e3d586848c4cf293cd7416a6dcf680818fc44fde0

SHA512
c2a90b5f220e85626b1b82affce88e508b65e0243f8c94cf5d9c19d45403d48cc0cbb92a00f3149bd4bbf5ba7e80ea6f37cc3386a3e38257ba9314de4218c98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1f1d2eac7b8e69984667c49df65074f1

SHA1
a2525df312d2d0dd4a650ae3fe842ec86a4c0a70

SHA256
996917a6b2306cc72ceb16814f2583a31e5e83ea060a6a069b7664db6e1e61eb

SHA512
1482c857240a1ea64eb37fc9339951e53d7d757904aea87261126f7ed3fbfd7db27e22404831b5ea0aed8b0c6a6f17d4770c3816230e0c9bf8852e66ae31639c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8ed63418ff56daeb417fbdb254ecf02f

SHA1
5499c9d18cc549c0b1e4631f88be0ccb725dade9

SHA256
fb989e45d924dbe7f7275c9d625433684f4bee33dbabaf260244a75b8b82a249

SHA512
bf21b80ad0c192514c64c746260d281e7816f28d1693e72f59d59b9950bc492b2933a7ddabb50b49ce6cf7eeea454e960165429bf77aed440811584279887118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9b890d7b150463595588d5babe0930ec

SHA1
e1443d23617fa7fdb972875743b5d6c185e9c028

SHA256
14b841e97527cf4a3de17a83ebb5f5c54eeeb8cc4fdb4ebbfe17ff52342ea52e

SHA512
bce0ecb0b779dc38a51209fb6250916738269700fcd500bc737d6709d64e0fed04f54cb14b10ce9a6a8b4ebd80cc0e2141dc542bd7c1f6f6939c63fca17f6814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e399.TMP

Filesize
704B

MD5
7fe8037d7d621ddca7c50ce6f2b84d1b

SHA1
6df95dedfbfd0e0b0b55dfc5146c91e7b5d55026

SHA256
7cba00e0e037976e3c4f4cc87a17d122ea3c5d1130d0b4f41ac5264fed14ee85

SHA512
fe36411006382cd7358cd89d3c1e2689ccf8dc16e682d503201d66459847ba72fd2c518ddfeea7e5794a0137d83e75fea13986d285d2b70dbee13cc1fda86b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dda5df68-54a6-45d5-aeec-58fc59009328.tmp

Filesize
1KB

MD5
d99fbc3ddcf2ccb6ba77d0630af3a412

SHA1
4b8af8c0e821e06eead0cd0f970a839ee10eeb5f

SHA256
50a7cc7170ab914e8209f107fafb8165e31d080ffe6c2fdf750dd94e8bffd22d

SHA512
7a86dfcc2993e0eb08b4f6b1f2d24c2f4ad4a64b68130861ec5228389f9899750513edea3be1a47a7d42ce6cea49e4f2ff8417250347b147e4fdcea199358188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc697af5e185037f3f33f0fb8b0255c4

SHA1
e257ec98f0440d426567a1c740205f2c653ee2fb

SHA256
b768987a8239c62374d36f21e47d5506612bbbd3e2f359527f5deb78695c3b94

SHA512
792fb93caff8c4e2090c2b8160edf8e07aec6ca88fda34a8a65cee40b6a6c1708776810ed74c7f8b05a7ab989abecbdd0985a022aa8d96ef6a157c911b99dda4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit