hxxp://sgie00fbeq1oba[.]w1708-2cc1[.]olxarv[.]store/?c1=c0PAAALrIAACvFqMaNViw5w&c4=zi4425549

Resubmissions

02/09/2023, 03:26

230902-dzah5aah7x 1

02/09/2023, 03:19

230902-dvcgxsah4y 1

Analysis

max time kernel
207s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2023, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://sgie00fbeq1oba.w1708-2cc1.olxarv.store/?c1=c0PAAALrIAACvFqMaNViw5w&c4=zi4425549

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4204	msedge.exe
4204	msedge.exe
4040	identity_helper.exe
4040	identity_helper.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2456	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	taskmgr.exe
Token: SeSystemProfilePrivilege	2456	taskmgr.exe
Token: SeCreateGlobalPrivilege	2456	taskmgr.exe
Token: 33	2456	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2456	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe
2456	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 464	4204	msedge.exe	82
PID 4204 wrote to memory of 464	4204	msedge.exe	82
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 1340	4204	msedge.exe	84
PID 4204 wrote to memory of 4152	4204	msedge.exe	83
PID 4204 wrote to memory of 4152	4204	msedge.exe	83
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85
PID 4204 wrote to memory of 4412	4204	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://sgie00fbeq1oba.w1708-2cc1.olxarv.store/?c1=c0PAAALrIAACvFqMaNViw5w&c4=zi4425549
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c3b146f8,0x7ff9c3b14708,0x7ff9c3b14718
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17212952957790261051,3125279244662145116,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
184c5c7572a6b42b329aae4e94e9b801

SHA1
adc61339fa23296b5271ac2b7e0de1d7390c4e12

SHA256
ce44f115c3b1677a95d69195266225da59f4dd8cd9d57fd713df35b91cc564b1

SHA512
692f524f7b95da9ef6e247772dc5e949fa3aa34a61675fa5c59698583c1708f0aecf454a06f8deb8bdd7690fce5bc9c76bd2a544ea6354fda15a924480eee820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
09535b7bd20a0efe5a0717d7aa39b97e

SHA1
e88d1b81df79f803a218ab1207fec3ad381d2dc1

SHA256
8482d4789696c0e9a626e8cf6dded933edf10a63e4a1de93e0ad139d165f181b

SHA512
18ea3cbd3166982705983b1581d97b56b184d17819f7c423e914f1f891cd664396a33e73118a8d686f1f1ea27d2d6496ff4d499407659d3b261af5caa95c8b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
ed2fa96b8ebd01f733f0045d0ab52dd9

SHA1
71456763708bc4ec1b5f734d913fa62d6be182cd

SHA256
923b0a0b2b65d94b615119e5913af794b6e4f205df480e50e9c36b18f0a5e86f

SHA512
ba2a04f8f698a3b63a405a7e1226d078a06b8460d88d789cc0d18daf891dac0fe3d0efc06d02bb2853dbcd984033579bf81b8af461bea817263aad48cab57e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8b066c08f7c5d7e96a4697fa3476f07e

SHA1
97388b5954250c622a597d2f60b509a13fdd1b5a

SHA256
f90b2ff6569f6b9512a9e6791cf5b3459723ba37c0eca364e4d676feeba56896

SHA512
88db3e25664820b4945d377055fed63a355ba7150f361bedcb820a34e4ff707d4ced6a39980b0c9c952f420f32d6547be7fdf0ef4c0cce7dde8d0b97bd14a70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
256aba2a657aac57b4ed2ff2bef1eaa3

SHA1
8a7b009196b9b4dc73e3b4f71009c9dfaae1a1ad

SHA256
71bea3f9de278ceaa9b3fd29bdd9b48cbf14989732795e7cf4f94b0dfe7a235f

SHA512
d88059e92654b653ae5ef4627322e7551f645a244308dbec0895b294772553a62300491fcc32e318039f4cc8a5a8bc6e91f60b4f5e7b742b301def25efd9d9a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee08bfd70a1061bdba588fbace8dcd1d

SHA1
2663427cb673fc2fba53af44dd4ea4cc9b78c766

SHA256
05954570fa4d504a4ed84d81e9e9e14c6fd3333c38f3bd979e4aac5c92dac05b

SHA512
03d6946310b8d4d3d47854440e649df97adf96026995eee0a0e7ef161a6e74cba267d7d642ba7b84d59abbf5f09a66cd2fd1ae70a9e2f70cc78564c9714bd415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5e715e5ab2946d97867ff90e048dbf6e

SHA1
5d99ada68893c0e097ad861b7c87f616a62bb7cc

SHA256
a5305f51acb24693ee4b63d5acbb5bb5ea2962bf14533e58e94902bdf98ce3ad

SHA512
b80862771cdc01c933b4b2184ecb07eb49a144035daa5dd1a683d64e7f7d7244776846da57810504ba66a026e3a9f072f588fdec20ef2223187e3724eb9fbab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
45b32885d9dbe5ef33912cbbd5b56d16

SHA1
025fc091ac899e673320da334402842c1e628f39

SHA256
de4e45efc0fddca1ca4d8ab074de7f9d2e0fc9831f511c938a75a5eeeda3a1f4

SHA512
deb4f7b5014262051385bb51305168799c52920834f24c86c942653c73bafb753157baaa049152fa683938ab142552998bc073cf695f66f2b2298f32febf201f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8a72ce994792bee71b1182a72748f84d

SHA1
4cb3cf30f92d72905aaa7b9f48c736c1894e5e13

SHA256
24a008499f84315e47e66e0adcf7cec016b53bceb410e698b1f62666e3d5fe89

SHA512
a56972572ce223e5218e0c5b33e78a5b74dcbc4e1ffe72cf84d9f52c7ce7783cdd4235e3ce32abfa7c28e1db4728d8d94a12228b2b8004289b6e34cd02a926a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2236cc12bac28f32727898f8e798ea71

SHA1
60b010388e64c9c6b7278329c25ef18895c2e4ce

SHA256
fb27de22688cf0240d03864dcf317d31701e0f0da97f5bbe6e545030f5830d77

SHA512
df522872bcf008bd11e85c5155ead36c0bd2e33a0d44bf3c2ac7f52e6e0df3dcc3067165869509a1ac7167919509672fe7c961619a9f833e8a92a59de456ced6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f2c1eee58ceff17cda9284a35638c35

SHA1
4e88b86242698107a0355cee28692f4c98de944b

SHA256
9a80484423d48c5becd7eafa99330223816ff91508aad569c8c53e75b261c032

SHA512
220119bee4432e73143727c7121de1e0bc0ab1d0dc6876df934660e2992ad8a46bb0f506edd74dfe72ca6db537373d5e8addb213a8a46d1aa2ab89f9f0db36a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27ab41ca1c9218dd44c753478b1d3b1b

SHA1
1944fb08deed6dd5a48c85fc9b30b13e9375d5c9

SHA256
3d2d28cddae6617f021219744b394bb3559572c2062e45f1076ef5b49a860c45

SHA512
ff73d1181d5aab7736291a3a0467d0867e63afb7debe537a2a850593834e0d82a3dd97529361da1c2efccd3e0330efda323d339b282ded4ff395dc20473d732f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46737b2fbe8f97c3d1fc1ca7a9a2f23b

SHA1
bba72e90131739c16b43de7384ac6422147ee2bd

SHA256
21e2df303c9567b0390f69b59b7eaa116d87a9528d99e8b112e9c8b964ca76c4

SHA512
e7ea5476fae7916e49ed910e14023c553cc537c95f43c76659f3e7e333dd5f07735582b65644bf39e66dd5fb2d3c307edaa911c262b4c72119adf7c287a307e3

Download Submit
memory/2456-375-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-376-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-382-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-380-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-381-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-384-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-386-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-385-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-383-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download
memory/2456-374-0x0000013DFEAF0000-0x0000013DFEAF1000-memory.dmp

Filesize
4KB

Download