2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20231128-en
resource tags

arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
submitted
03/12/2023, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HorionInjector.exe
Size

147KB
MD5

6b5b6e625de774e5c285712b7c4a0da7
SHA1

317099aef530afbe3a0c5d6a2743d51e04805267
SHA256

2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
SHA512

104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
SSDEEP

3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2189761507-171623489-4293150984-1000\{3D996DD5-0DF7-453F-B50C-C6474F0FF83B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\Registry\User\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2189761507-171623489-4293150984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3600	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe
4804	HorionInjector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	HorionInjector.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3600	explorer.exe
3600	explorer.exe
240	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4604	4804	HorionInjector.exe	84
PID 4804 wrote to memory of 4604	4804	HorionInjector.exe	84
PID 3464 wrote to memory of 4736	3464	msedge.exe	93
PID 3464 wrote to memory of 4736	3464	msedge.exe	93
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 2796	3464	msedge.exe	98
PID 3464 wrote to memory of 4484	3464	msedge.exe	97
PID 3464 wrote to memory of 4484	3464	msedge.exe	97
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94
PID 3464 wrote to memory of 4572	3464	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe
"C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\explorer.exe
  explorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App
  2⤵
  PID:4604

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3600

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0dfc3cb8,0x7ffd0dfc3cc8,0x7ffd0dfc3cd8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1640 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1748,10652041533854328494,8770353015231905946,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3668 /prefetch:2
  2⤵
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2840

C:\Users\Admin\Downloads\MEMZ-master\MEMZ-master\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ-master\MEMZ-master\MEMZ.exe"
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2fdf029278a0dee411a92724272084f8

SHA1
2255ac6fb951928e43b1d6942babc1fd537b1b31

SHA256
9d0a95bba4fe224220477941236b19c9084805b27d6c52234ff9c223bfd9d089

SHA512
148fe2e6332311a3719ed205bd5f43bc25153f334ef7a0bc1f92c494524ae7b4b025df83964bfd4567123b859c78ada0857505420701e956cfd2c32a91d18d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
21KB

MD5
cd7f2cbf4c0102bf2f3254f46f01d04f

SHA1
7e7eaeb9bb84b0b1efdeca19cb77ee50841bcec1

SHA256
85576e5fe45ed5c52be852a58719d175e280f73537617348a705168090a1605d

SHA512
e25ee816c7a36219cce6652b89ff9b37f26dc24b9708494e4edb9d2602dae75c7f070aee06ec83ed65cb694742b2b0b25392ad51ec82f06fac0f9c867e72fe2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
69KB

MD5
c33c3755c9bc5c370e51bd72a524da35

SHA1
7b4d2ef2b5e0188562afcd4c87060a809a7d2919

SHA256
e30aeba2b555fe999989e290128024451d7b1bccd13060ce16990a39937a3113

SHA512
7c656b1f7e9806208c87b1f22d27f07f400c5bdd3fd258056a4046c7999d4f83f6c473800b09e36450eff9ff9dd86d045eedead515aeb4bdb55e9d9889e90de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
89KB

MD5
20b4214373f69aa87de9275e453f6b2d

SHA1
05d5a9980b96319015843eee1bd58c5e6673e0c2

SHA256
aa3989bee002801f726b171dcc39c806371112d0cfd4b4d1d4ae91495a419820

SHA512
c1e86e909473386b890d25d934de803f313a8d8572eb54984b97f3f9b2b88cbe2fb43a20f9c3361b53b040b3b61afb154b3ec99a60e35df8cf3563dabf335f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1010KB

MD5
ee765d67396eb813ab4a486ffc3096bd

SHA1
dc0858be6df2508887331bb9432687780f17312e

SHA256
3ed5d1a8ff4fc0a6c361f597c18ed692c1ea8934c0198123b4bddcd7085c403a

SHA512
cf9adcbb851d2dba940f91cc42d1c8c24f77c446153185e12be5858fd6e0e8e6f2aabe72659eae1decde9e37d21ac5792433d5057661dc5c6ce8275db61c25f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
23b383d7ab22ba8736c8d75aa650407f

SHA1
52e4d82baaced6771febbf1582ce327e6292939f

SHA256
92fc311a76eb7d6f9bb3497e72ed0356a89659c8509ec5fc1905998488653935

SHA512
0e3e250fdc30067d96b1a658ac7201d3a4521213b7a457bd4d53240d7e918849c34bce4efe9d8673d81ad181bbfbb8745c574e47fd9b477e50347c57fe08c34d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
930B

MD5
2cf1d8edfec89c34e894c6661c6afe38

SHA1
75c6282ce8a300d2da85a8a31d6c3309c75a496a

SHA256
73874924f34e9041b7c0bc2f3c90435deb04d5d530b55e8e8ba2faceb9d3fc67

SHA512
83af8e58b87df599877956ea1d9cac30c478f95b6fe7265b66aa54b4245c4548d8b310cda0eb81fb55abc877439a180273a4f5193745ce20f5672881a6ea4a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c7d2649bc4c0305e813d6e316e26ec1e

SHA1
af861ce4b26f37f7389b1915320d30b6495973e6

SHA256
33c2962ab4aa1758694ba07241f4c5c7d1702b13ab6f74eb777356662f3a1051

SHA512
a5df8f9c15da35d0ff25ca2573d35c18a73a7029d61cd32c7cf2fe612cebc650f3d9feefd00d0ad68a024e5e35856b4e0aef471aab4d42de44ee7920af65d3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f045f7a2ed6959fd2656b18080a24e4

SHA1
c6c96bef07902a66c5b0cccd1e0d1546502d9a27

SHA256
e337817fabc827d56ad69435f50b8f485a38fe83bc3c1db13b8efa6a38c318ff

SHA512
16f39a1b31f4a3819d105dbcb2578e12fd51e6ab4f57e5aadd372664eca2a9822cd9628a31284c53a5558bd01fd4179e78378adf0892daf86b979288bfe05f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de4be0d62346f17c35cf6675d175bdc6

SHA1
743cf64d98dec07374623d00dbdb9e736ff46d5a

SHA256
553f3c19381df705fa57cafeecb87d3a1a64468fd1899c67c2a7c73afca2f904

SHA512
48b4d0e85ec468fd072001b986eb167f6e836ae5185360bc39e184dd24acb90006632cd0bb85544d999c93f9076ecb6db6095193a2a0363ae81729e4b5572f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2c43de5d7f9ad48a53036c4429bdde2

SHA1
a6d38a92bb7d9defe8cbad5076282848578bb3c7

SHA256
fcf403a39fc8480924d773747a6a26781ee6258fdcc62f75f973c330115f837b

SHA512
d1e2a9bfe58ddfd05408d30ae2bf3336c8e8b83ca712380b48230a96f83772682744d3ab1e37884286ffc7d5e8ed0fcd2bb00a58ed926684c74535fd0a99a4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c965fea8ba6d79dee323ce53d055d179

SHA1
2a4d2a5bc232f091d2f252943ce04760f2b2a3f7

SHA256
54e34486aa0e739416735ccd26c9271fe41ae4a28a25080f7b2a11b08e4c576d

SHA512
2736d6c4b94c39e4d483044e54a6182f9aea376ede3bd9b719d8bf6a66a66e145c8f60b5de8718f6856e8dbca0134079d1d0724419922431bf969bd5d28204dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fc6e7cfac74124c5adca95de70e9d073

SHA1
0155fc9a407022ce218ff8d0397a18779f2a0002

SHA256
1c947decdec9340bbbbb7310d494ce51435df0c9a75c9ba887fb2b794426be08

SHA512
c3474149b9a889f1c5018b7ecabeddcf8b0b646b1befdfc671c400eab157aab9152d70f358c0fe7b6e89f3133709c63304dec007632f5ee3af5c9eb4c32c93f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588681.TMP

Filesize
536B

MD5
8fb5ffe2228a2dd4071fffcbd0cb1ce5

SHA1
ad917b8b44e89658ac0ce1021d33c6b2c083973f

SHA256
0216dddafe212402f839f414167510385e41fe8068caf3932e79d6c9e4ba4c0e

SHA512
8e6c1aa4d1ba881d35177599c182880c56aad27e4c50da7b793283652c412ac607bb5be2e66379c2822f1232110747afe118ac7a1ae886615af57a7ec9035936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7d5526a17738a370151dc81e15a5398e

SHA1
e661d8fa787726d4de113dc33b13e85536399a0a

SHA256
5e10c10e822e0b24deb488e3113c721dbcc4a38ce177206f55df140ba6bcb647

SHA512
9af0afe0c4e3d4b4843f5774d6ffe0d0af5cfc9dfcfa1f4528f834a7fff47f6c937919f17155fe7c7cdb25b4fed5aec86e34a8f49c69f2d1c4679e7190cc98d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe568fbdf64894fc11787f2e53b537fe

SHA1
ec9ad166f93d1e109dacf71e00ce6699e1bd6213

SHA256
dadb9f3cfb78b29ed17e5b8397c94419151949082309a0bba350364adcddd2c0

SHA512
0a5d344b35e51cd4a57e7ccf91a6ef5bf7648bdc67c7fde15f3acc7096322ddee14fb5fcf6f5647cae8c15f0915823fa8d4ccadf778456862bcb1fbb420e9d71

Download Submit
C:\Users\Admin\Downloads\MEMZ-master.zip

Filesize
9KB

MD5
cdc16ed0871d6ef790d94eb87221d778

SHA1
7412475b1214809809aaf71a8c7c96fa71620dec

SHA256
e27df818e614ee02d5f78c909a1f0839ec96644c16284c553f22e1e9c2719b4d

SHA512
f9de6ce5c2b6e7504625f6913fd4bd868b6eecfd1006cadeccc82577bd052831cd4104b4473b2b5d4b0f60a21f230ae85b165d71a313915b92636e52c8f9bbae

Download Submit
memory/4804-5-0x0000024CE6040000-0x0000024CE6048000-memory.dmp

Filesize
32KB

Download
memory/4804-6-0x0000024CE5D50000-0x0000024CE5D60000-memory.dmp

Filesize
64KB

Download
memory/4804-4-0x0000024CE5D50000-0x0000024CE5D60000-memory.dmp

Filesize
64KB

Download
memory/4804-7-0x0000024CE68A0000-0x0000024CE68D8000-memory.dmp

Filesize
224KB

Download
memory/4804-8-0x0000024CE6640000-0x0000024CE664E000-memory.dmp

Filesize
56KB

Download
memory/4804-3-0x0000024CE6080000-0x0000024CE613A000-memory.dmp

Filesize
744KB

Download
memory/4804-13-0x00007FFCFC820000-0x00007FFCFD2E2000-memory.dmp

Filesize
10.8MB

Download
memory/4804-0-0x0000024CCB7E0000-0x0000024CCB808000-memory.dmp

Filesize
160KB

Download
memory/4804-2-0x0000024CE5D50000-0x0000024CE5D60000-memory.dmp

Filesize
64KB

Download
memory/4804-1-0x00007FFCFC820000-0x00007FFCFD2E2000-memory.dmp

Filesize
10.8MB

Download