Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2023, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
Dusk_v.4.0.1 (1).exe
Resource
win10v2004-20230915-en
General
-
Target
Dusk_v.4.0.1 (1).exe
-
Size
7.4MB
-
MD5
c02d11e3b6bc705388b76d1a4e1fe2ab
-
SHA1
333b393ef634896278ee65cc67c9ca0e95bc402b
-
SHA256
5e31a80b81c8e9a2e7a56dc937b89ad30b9eefac1a2e8eab562d02c9fe02d761
-
SHA512
0e6fba71a56c5cf6216183a21063e0130588096b30e0274bc5f74b8dc4599701fc1331c1e28caef9334176c2f5a52184543b978f60cf9b8019ac1fd0dfe6f8cc
-
SSDEEP
98304:WIjBRnkn3aAZ5y50+AhlS3hjlIZT/mMNNjtwlUw/civJQM3Yy9MFmX//eV4d/:rDwn+WS35lI1/7NNdYJQMI+uEY4d
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 33 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Dusk_v.4.0.1 (1).exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Dusk_v.4.0.1 (1).exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Dusk_v.4.0.1 (1).exe Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Dusk_v.4.0.1 (1).exe Set value (int) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Dusk_v.4.0.1 (1).exe Key created \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Dusk_v.4.0.1 (1).exe Set value (data) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Dusk_v.4.0.1 (1).exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3736 Dusk_v.4.0.1 (1).exe 3656 msedge.exe 3656 msedge.exe 3736 Dusk_v.4.0.1 (1).exe 4600 msedge.exe 4600 msedge.exe 3736 Dusk_v.4.0.1 (1).exe 2204 identity_helper.exe 2204 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3736 Dusk_v.4.0.1 (1).exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3736 Dusk_v.4.0.1 (1).exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 4600 3736 Dusk_v.4.0.1 (1).exe 98 PID 3736 wrote to memory of 4600 3736 Dusk_v.4.0.1 (1).exe 98 PID 4600 wrote to memory of 4964 4600 msedge.exe 99 PID 4600 wrote to memory of 4964 4600 msedge.exe 99 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 2272 4600 msedge.exe 101 PID 4600 wrote to memory of 3656 4600 msedge.exe 100 PID 4600 wrote to memory of 3656 4600 msedge.exe 100 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102 PID 4600 wrote to memory of 2352 4600 msedge.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dusk_v.4.0.1 (1).exe"C:\Users\Admin\AppData\Local\Temp\Dusk_v.4.0.1 (1).exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://duskclicker.xyz/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd9b246f8,0x7ffdd9b24708,0x7ffdd9b247183⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:23⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:83⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:13⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:13⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:13⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:83⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:13⤵PID:2596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:13⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,7330610464876285748,3890708508936954754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:13⤵PID:2844
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4528
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD516c2a9f4b2e1386aab0e353614a63f0d
SHA16edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA2560f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD527df9103dce78b92fbcb7deff1daec8f
SHA1883780d913a90033605fe5b35994f9667fc6a4a8
SHA256cefa45a46fac7133422e753c550e51fca1915965d9c72a0e09b73437a7063631
SHA51257b5967868b20c8e89a170401a8813201856570e2689c52a2cac85e4dba513d41abc63fa780e69e967be02250ac60538514f5cbfc395d90067defb06277cb31a
-
Filesize
5KB
MD5912c409f347adf811eb37bf1ad98c9b2
SHA14da79f1f3b3eb93a7586413a9709440823ab889e
SHA256eb8a35cbed4776cd1e76f2f31ae4fcbb7b64e751b4a50a5d4459d00427d8b20e
SHA512fa970330f4ba03285239dadbe47ff4a259777d8352b14b2358f5860c9e3148f8282cb1efc33ad48460cb20a6a168a64c6cdea6486ba7337654e72125957d4bb0
-
Filesize
24KB
MD5699e3636ed7444d9b47772e4446ccfc1
SHA1db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA2569205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e7bf56a8bd5b3f6e02c3185c86801f44
SHA1a2c0b87f3da0cb1b8745f0aad93f686d20e26ff1
SHA256ce57d53f0b0f45335aaefcb954bc3f497b4757c13b45f5ae92f75c53df9b0e20
SHA51283c166a0ae72a20862fec97441a892d1004a3144fc661e08ee513953ba77bc1b15c8243ff723f3539ca02772137602311ebd68ed88e96067e93eaec3bb42d410
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_D2D8FEF9CF3F4A3BA7F54B410AFEBA88.dat
Filesize940B
MD5a004e1339e1cd9a4242e7edc2e379b13
SHA11c19c8dde7e0b402c3b926d2607795d300a75192
SHA256419a32f7a029ab75ba586f3c1617913d2a0d43cd47a7ed3ff1055002a9c3a4c7
SHA51277109b7e666c33e6ca82d15198259b303f7bb9b1a37797b2e74d609ad0732f6908f67eabb47795a83bd099fc03aa481a313dc29423440a7600f09832f67ecee5