cbf17f82858d9fc4fe843984dea3cc48eeb379c792304aacfa503e4055ec8be2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57c7b653c5415812d1a66aefe17f38f1.exe
Size

188KB
MD5

57c7b653c5415812d1a66aefe17f38f1
SHA1

4e4b8d035949f71bac62eab48d937c96be2b7c76
SHA256

cbf17f82858d9fc4fe843984dea3cc48eeb379c792304aacfa503e4055ec8be2
SHA512

9c518531ae5dd15914dd2b004c89db0b7af686b81b21db070b289b3a25fb2d150bef253fb8c4bff7f064919f278079925a171d972da4ac12e9f5d36bd4c21973
SSDEEP

3072:R/IV9UTsqYYCZ/bUQfizbFW3rXMzxArVrlKY8Smn0eq:SV9m866rMi

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
151	api.ipify.org
154	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1168293393-3419776239-306423207-1000\{30ACDD29-56B7-4429-A88B-9334E6D7450B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
2848	msedge.exe
2848	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
5300	msedge.exe
5300	msedge.exe
4972	msedge.exe
4972	msedge.exe
6136	identity_helper.exe
6136	identity_helper.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
348	57c7b653c5415812d1a66aefe17f38f1.exe
348	57c7b653c5415812d1a66aefe17f38f1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 2624	348	57c7b653c5415812d1a66aefe17f38f1.exe	99
PID 348 wrote to memory of 2624	348	57c7b653c5415812d1a66aefe17f38f1.exe	99
PID 2624 wrote to memory of 4900	2624	msedge.exe	100
PID 2624 wrote to memory of 4900	2624	msedge.exe	100
PID 348 wrote to memory of 1288	348	57c7b653c5415812d1a66aefe17f38f1.exe	101
PID 348 wrote to memory of 1288	348	57c7b653c5415812d1a66aefe17f38f1.exe	101
PID 1288 wrote to memory of 2196	1288	msedge.exe	102
PID 1288 wrote to memory of 2196	1288	msedge.exe	102
PID 348 wrote to memory of 4876	348	57c7b653c5415812d1a66aefe17f38f1.exe	103
PID 348 wrote to memory of 4876	348	57c7b653c5415812d1a66aefe17f38f1.exe	103
PID 4876 wrote to memory of 2960	4876	msedge.exe	104
PID 4876 wrote to memory of 2960	4876	msedge.exe	104
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 1284	2624	msedge.exe	106
PID 2624 wrote to memory of 448	2624	msedge.exe	105
PID 2624 wrote to memory of 448	2624	msedge.exe	105
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107
PID 2624 wrote to memory of 3532	2624	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\57c7b653c5415812d1a66aefe17f38f1.exe
"C:\Users\Admin\AppData\Local\Temp\57c7b653c5415812d1a66aefe17f38f1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tinggalenter.blogspot.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ff7d46f8,0x7ff9ff7d4708,0x7ff9ff7d4718
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5728 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7096 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7553898246140063886,1216717018353343947,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://obrol.net.tc/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ff7d46f8,0x7ff9ff7d4708,0x7ff9ff7d4718
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,12456352866186669009,8614610897489776397,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,12456352866186669009,8614610897489776397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://adf.ly/3UMi1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ff7d46f8,0x7ff9ff7d4708,0x7ff9ff7d4718
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,1165320913952980672,3607964875868619118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12f5ea17522d20f57cfc7ed287507d1c

SHA1
683a34647d67a7f0db4b48c8e5ab2bd96b1ae58b

SHA256
25fe9a74a26f05364d78e4fef7962b5509f562c825da977bf6ee46a31e2392cb

SHA512
6ba3e8a3b7eb2fbd8edf13571a7a430b334dc86527eb4368ba3b8c2e7bcd24073cca99677ddffa633643046536bf7c7516076a9018f7b3c7c63a9f2a26de67c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95e61e61-01fd-498b-a3df-54f75154fd29.tmp

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
21KB

MD5
a8b7b256962eac35b073d634868a231c

SHA1
dfc1d2a914582631c96ad1eb929ebd30ff31efe0

SHA256
74bece3266374f5aa3043309d94a5cbd2ea847be1a5bc57460693c165a5a0b09

SHA512
3957a2770948727731faf45bb74574e9597d46a89c8bf7d6f9ffbc21b32428bc8a88836d7e91f33753ecb3c0bd0fc3f23f431f687128fd83f6309ef753f7715a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
44KB

MD5
aa2a65c96f7fdb26505e70abac1d03cf

SHA1
f960f30e0aa266e8b23d52c241249e8ca18c1679

SHA256
5a5a77f2321c2400046e66dc560304bf4187a2368f62aaa84ef9cdf21d7b726a

SHA512
f2c479bd9bdf8531d5cabcc6b722695aa0ce7de473bc5623beced1a45ee7d7418d43f8f9fad1a3db7f401c8678e7fd354159b0620f18bb024f534893e40a1071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cfcbe21fbe1e661ec6420e81265cef93

SHA1
8ab66b46b6e7a3e094a4d5e94fba23a7629f880e

SHA256
8fb7b65e2e8e7aa089ca5f48f6b62f255d5dfbc788a4f329faedcccd8807d5f8

SHA512
9c4610bc83e3b8c3dc83e6baa377c515de2d0e1070bc4b8f4af0fadbddfe6f5f69ec4bb60d89b65056caab1fa3089964df04104076ceb66b2281292abad16e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
e5c6ff17328af7c41be7ad2fc58aec60

SHA1
1b3ac628edc12bb1f8aa3dbaa50e84f4de7f4f34

SHA256
2deece621e80275d50701bd1ea68cb024e48e4294b22184c8932f77bc3b4656a

SHA512
f089c634c41e7b1477a9ea3c3344088d18663c22f03dc2ecaff2cb01f621e8351f8f06fce13fe9e87f71cafe2c3b8a333e6d5065c85017f28883f13db74f6043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d5c63a86adb0b5f2545b8f2ee21156a

SHA1
fa58569fc66374d8ae58dbcffab4563c4bb11206

SHA256
3b57ff6ed4041b0bddfcb493edc813614bf13292cac285123b19cf17842f1ca0

SHA512
b6e7789595b5da557e72c2613c368575baf21bf15a826a695b53cecbd68de8938da2e9a6cef3259331bba72f747b718753ad0e86aff88196ad8f2c88faf8d10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa9d346101b1ffb93a38be7dd1b2f700

SHA1
221b34009ff69caa0c73ec073795bf23faaf527a

SHA256
b083c4c030f63ed3ba10264f68d11f587737eca357f0b12853f1df788caa7245

SHA512
e1ce54e37960c86ae9f383b481e5733b472eb72733bc70a34e51e466389b22d72a7ffbc0c92af334a4ec2ecb11b288b8d8986a7e2c1e80593d0ce9d6c5cd6b9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
011aff4fd6ea3e484928d9d8d0875de4

SHA1
e50791e904518dea6656fafe278fdfdd27eaa9b3

SHA256
e868a8475b7cb9416134771289c4ed43f6271a472219026eebe531588a0346a8

SHA512
33d62c980fa3dc91197153c9bd1219f838c2bf991108235a3e31a7de544b20c27e0c0b27591d3f3cb0fb6d194487fa150e9c4234124ba03e65718383d9f188a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cca6.TMP

Filesize
2KB

MD5
2d5f6886d1710dd4f60d20d0eb01ef1a

SHA1
348833400c1000d66876b981a840d0aa56651707

SHA256
6a8a4b2b5a0d424b0301dac0b9b67691b779d9fe48088af2f6bdc6e9194b1cb2

SHA512
0758432d18d0e18245551c93df4028654b117c40f3aa0f4d7319295421dd0bddd3a824b7da8f75edf3321effb17e1169e5a8f7de2167794d320589178ee0b086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
fc9b85cb5104d12e913c445cdd142da4

SHA1
d1444e0fb006230f17a3f0622e6fd235cd0416d3

SHA256
0e63adbed2855fb46cadc3530f642e436106ce0cda900098e284f993e1d2797d

SHA512
cf8d50232f70ee3d15107116d4c67dece15755863eed248cd46ef74c688919b31cced95e2ed8931d4b087d4e6ff15da7d8600fd737a218b60bf733f96f02900a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
eaec632c8c38227bec23bdc567d400d8

SHA1
2679173de1b0e3ab30c35bd17ab21d9d51e7614a

SHA256
0e8a92c90c698c8a76882eec325a9bed627f09372d6fb77193d2a57383b12686

SHA512
9fa3b4202199b3cd3a285300acaf87146c67b22bd9e7f57e9edda656407c9841b630e364e21f27ef8a9225d123c4fabc974821749d34e0af211a96eede4c6f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3404e4dbb88868eeff3b9c4614c5c19d

SHA1
d3c10d17d33cde3ab01960404e83e101be1d5c11

SHA256
9b565d6e8df32ae6d081ec093146fe1904ec02e882bd33f1bfbdda191a92d89b

SHA512
54a4557257b192afc73bb2411ae3879c90afee5d6cee83654930861426761baf6f85020a342e60a4fe0f934f2aaa9aaf6603fcec3e3460013c14ea49087ccc0a

Download Submit
memory/348-3-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download