5e31a80b81c8e9a2e7a56dc937b89ad30b9eefac1a2e8eab562d02c9fe02d761

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dusk_v.4.0.1 (1).exe
Size

7.4MB
MD5

c02d11e3b6bc705388b76d1a4e1fe2ab
SHA1

333b393ef634896278ee65cc67c9ca0e95bc402b
SHA256

5e31a80b81c8e9a2e7a56dc937b89ad30b9eefac1a2e8eab562d02c9fe02d761
SHA512

0e6fba71a56c5cf6216183a21063e0130588096b30e0274bc5f74b8dc4599701fc1331c1e28caef9334176c2f5a52184543b978f60cf9b8019ac1fd0dfe6f8cc
SSDEEP

98304:WIjBRnkn3aAZ5y50+AhlS3hjlIZT/mMNNjtwlUw/civJQM3Yy9MFmX//eV4d/:rDwn+WS35lI1/7NNdYJQMI+uEY4d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Dusk_v.4.0.1 (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Dusk_v.4.0.1 (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Dusk_v.4.0.1 (1).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Dusk_v.4.0.1 (1).exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Dusk_v.4.0.1 (1).exe
Set value (data)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Dusk_v.4.0.1 (1).exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3736	Dusk_v.4.0.1 (1).exe
3656	msedge.exe
3656	msedge.exe
3736	Dusk_v.4.0.1 (1).exe
4600	msedge.exe
4600	msedge.exe
3736	Dusk_v.4.0.1 (1).exe
2204	identity_helper.exe
2204	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3736	Dusk_v.4.0.1 (1).exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3736	Dusk_v.4.0.1 (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4600	3736	Dusk_v.4.0.1 (1).exe	98
PID 3736 wrote to memory of 4600	3736	Dusk_v.4.0.1 (1).exe	98
PID 4600 wrote to memory of 4964	4600	msedge.exe	99
PID 4600 wrote to memory of 4964	4600	msedge.exe	99
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 2272	4600	msedge.exe	101
PID 4600 wrote to memory of 3656	4600	msedge.exe	100
PID 4600 wrote to memory of 3656	4600	msedge.exe	100
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102
PID 4600 wrote to memory of 2352	4600	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\Dusk_v.4.0.1 (1).exe
"C:\Users\Admin\AppData\Local\Temp\Dusk_v.4.0.1 (1).exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://duskclicker.xyz/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd9b246f8,0x7ffdd9b24708,0x7ffdd9b24718
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
    3⤵
    PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27df9103dce78b92fbcb7deff1daec8f

SHA1
883780d913a90033605fe5b35994f9667fc6a4a8

SHA256
cefa45a46fac7133422e753c550e51fca1915965d9c72a0e09b73437a7063631

SHA512
57b5967868b20c8e89a170401a8813201856570e2689c52a2cac85e4dba513d41abc63fa780e69e967be02250ac60538514f5cbfc395d90067defb06277cb31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
912c409f347adf811eb37bf1ad98c9b2

SHA1
4da79f1f3b3eb93a7586413a9709440823ab889e

SHA256
eb8a35cbed4776cd1e76f2f31ae4fcbb7b64e751b4a50a5d4459d00427d8b20e

SHA512
fa970330f4ba03285239dadbe47ff4a259777d8352b14b2358f5860c9e3148f8282cb1efc33ad48460cb20a6a168a64c6cdea6486ba7337654e72125957d4bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e7bf56a8bd5b3f6e02c3185c86801f44

SHA1
a2c0b87f3da0cb1b8745f0aad93f686d20e26ff1

SHA256
ce57d53f0b0f45335aaefcb954bc3f497b4757c13b45f5ae92f75c53df9b0e20

SHA512
83c166a0ae72a20862fec97441a892d1004a3144fc661e08ee513953ba77bc1b15c8243ff723f3539ca02772137602311ebd68ed88e96067e93eaec3bb42d410

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_D2D8FEF9CF3F4A3BA7F54B410AFEBA88.dat

Filesize
940B

MD5
a004e1339e1cd9a4242e7edc2e379b13

SHA1
1c19c8dde7e0b402c3b926d2607795d300a75192

SHA256
419a32f7a029ab75ba586f3c1617913d2a0d43cd47a7ed3ff1055002a9c3a4c7

SHA512
77109b7e666c33e6ca82d15198259b303f7bb9b1a37797b2e74d609ad0732f6908f67eabb47795a83bd099fc03aa481a313dc29423440a7600f09832f67ecee5

Download Submit
memory/3736-8-0x0000000006130000-0x000000000613A000-memory.dmp

Filesize
40KB

Download
memory/3736-20-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-11-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-12-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-13-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-14-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-15-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-16-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-17-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-18-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-19-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-10-0x0000000008EA0000-0x0000000008F3C000-memory.dmp

Filesize
624KB

Download
memory/3736-21-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-22-0x0000000001B80000-0x0000000001C2A000-memory.dmp

Filesize
680KB

Download
memory/3736-26-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-9-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-0-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3736-7-0x0000000005E00000-0x0000000005E32000-memory.dmp

Filesize
200KB

Download
memory/3736-6-0x0000000005E40000-0x0000000005FB6000-memory.dmp

Filesize
1.5MB

Download
memory/3736-5-0x000000000A160000-0x000000000A170000-memory.dmp

Filesize
64KB

Download
memory/3736-4-0x0000000005D20000-0x0000000005DB2000-memory.dmp

Filesize
584KB

Download
memory/3736-3-0x000000000A720000-0x000000000ACC4000-memory.dmp

Filesize
5.6MB

Download
memory/3736-2-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/3736-1-0x0000000000740000-0x0000000001282000-memory.dmp

Filesize
11.3MB

Download