hxxps://www[.]caribjournal[.]com

Analysis

max time kernel
160s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.caribjournal.com

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
191	3580	WScript.exe
194	3580	WScript.exe
196	3580	WScript.exe
198	3580	WScript.exe
209	4144	WScript.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
3188	msedge.exe
3188	msedge.exe
3160	identity_helper.exe
3160	identity_helper.exe
5384	msedge.exe
5384	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	taskmgr.exe
Token: SeSystemProfilePrivilege	3728	taskmgr.exe
Token: SeCreateGlobalPrivilege	3728	taskmgr.exe
Token: 33	3728	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3728	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe
3728	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 3524	3188	msedge.exe	85
PID 3188 wrote to memory of 3524	3188	msedge.exe	85
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2372	3188	msedge.exe	86
PID 3188 wrote to memory of 2336	3188	msedge.exe	88
PID 3188 wrote to memory of 2336	3188	msedge.exe	88
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87
PID 3188 wrote to memory of 632	3188	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.caribjournal.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf5e346f8,0x7ffcf5e34708,0x7ffcf5e34718
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14463761265286784304,4283576527356578103,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5652

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\UрdateInstаller\Version.93.9025.75.js"
1⤵
- Blocklisted process makes network request
PID:3580

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3728

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\UрdateInstаller\Version.93.9025.75.js"
1⤵
- Blocklisted process makes network request
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C768B3711A40923511156E1AB97E459

Filesize
316B

MD5
c56434f0f6fe46fc9eac2358ec858ea1

SHA1
02c026703287f61e94d5811e054e20d518a36fb9

SHA256
d8a5fdfba7c8372d2040a29ecc45c0317b07a3facaf28db80fb42bdd35fc4b51

SHA512
4f982ea87fd87c6843c860fbcbb4dc3cdb7cb757f2be2ff93c1c68eae52653286ffe58bb018ccab2d74217294fd280dc72c55c391e92cb537abd3bd7cbb19ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
1KB

MD5
56ef08a3e40e9a4b56c0f3e8524fa55c

SHA1
dc5f02ddc5b5bb08b78d14ca32eccd9e9a745cb0

SHA256
3b44e2453400e95680ce3f72c7ab4117b4f95b8e076125873d874467265c964c

SHA512
3b886471bda1ca4248f9e6404e72a7704ab353a1437cdcebb5009fefef468fd30bbd78dbb7eeaf9e9080713ee2f0f31235b5c2c0614e040950c406b06f17e10f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_03D1B482EE3032A122274428715A4E19

Filesize
978B

MD5
36d25c74190c5003cc667b232fb80a1f

SHA1
9a1f421ab9337b64b6f482b3f3ec296ee1868783

SHA256
bb40f82b866357bb288d38037ef9885450962ca0a7e4d7b7f1868bb05c707289

SHA512
2eef82f7dea141fe20cf647d7c3ff527ff38244b0a90e2fa59d95299d6c6b9f9081859658e265015f37cb74e184bdf27c26db798711af1acc8f93101b4d0a0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C768B3711A40923511156E1AB97E459

Filesize
504B

MD5
118f7d8f9fe68aeff3b87b5237621207

SHA1
6b09976aba66bfb7f23aa96fea86f890ba17799a

SHA256
06719e5f73c2cfeb8b13fe7c3c5633e35c63064fdfef2aaf0abc504d4583c6df

SHA512
c49e8e5639908a1b15a6c3aa2f6f6de85e17bd760c59da469c77b942aed250b435358ac0992e2f2d408b5c4ae2f74fdfe6219ad6472450e8b9f3c6177a27e909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
6a0d39131604baf2cc7e7422816a7f14

SHA1
251f4a7e2ff6111be7c504dac43a3d8973018e2a

SHA256
ed00119337d31b2d5388ec7cd1dbaa11b531acde88544e885f57ac8dab20c7ab

SHA512
0263812470589d4f21300e7eb7680942cef1e9078dbcadb63b901d0bb3a95ac2838bb20cb4bf467b54a8fabe6ccce608838cb389061acb73a475fe28b9277902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_03D1B482EE3032A122274428715A4E19

Filesize
484B

MD5
7f096fe3e4095c31a782c32dbbb2fb28

SHA1
19853330e14d18318999bcdf10b940e4dc1734bc

SHA256
df11cf52a1b9ef1f74eefcfd86b3b3a2f3d8a2e767edf238005454565989372c

SHA512
3244b04c3870f28aeb543dd7bc6b7b250df7391b8aed1266393362f899c6c6992e7b36ba9ca6223134793114d8d7569a9f9069798a3cd2123d5e1e05991ad863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eb20b5930f48aa090358398afb25b683

SHA1
4892c8b72aa16c5b3f1b72811bf32b89f2d13392

SHA256
2695ab23c2b43aa257f44b6943b6a56b395ea77dc24e5a9bd16acc2578168a35

SHA512
d0c6012a0059bc1bb49b2f293e6c07019153e0faf833961f646a85b992b47896092f33fdccc893334c79f452218d1542e339ded3f1b69bd8e343d232e6c3d9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bf29e8a02f768a3ced412b00dc575031

SHA1
7b316751ddb16fd43b8a0d5a4d7225f6679c0f74

SHA256
a1a3bb6f99f45e9405bf13ec8fb494d5327373ec6c543a8345d7cfd3f7bc7236

SHA512
6d85323fb3eb7bff70f2c2c12bf85f5de1f14cdc3cca13b333fe2ba16fc3fc7bca394c02a4b9201a58bb55dc3ef795ccade14287a1d5c2a7bb47ad0be64363af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
64b32e54744435a77770c05c39db0706

SHA1
d39739f91b4f1e5cb84345e82d29ab89353ff563

SHA256
bb06148344e7f830754e58f66212bdd12ac53f4bdc822921184acac9b1896c06

SHA512
7947dd7c503074bb0bab049bef0eed4dfb502cabac338ddf2c9910278155de9689cbcd7be713cf3ee357c69d1f355ab5bf3508b9a302ff6202939c78ce40c721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
55c7c0ace848bb30a55993340b90db12

SHA1
69edecb445ce72626eec72877c6fd0da33318433

SHA256
6afd7f1c3e95f03ff7c1ffd05defae6ba362430819bfd240c0b60a7a12ea2e41

SHA512
a5b274b3185b8996055a318d5b979e0fc05fd9273145b9e6c798da28f2d6529b4f32fae7f7eac8283ebeca803913a3a2cd6eeb2ea53af10c42f7c26eb21d0abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
197b4b685640e0308f17eeb50d206217

SHA1
531d952ddb416333c24330e6fd272eab5c20ad57

SHA256
7bbaa701ceb1f928306baefba406ae82c5b41ac1e9ae0fff56ac7e3d36fadcd1

SHA512
0dbb64616200fbf9996165de35c605b67c013300fbc0c46039e1f55e7935c4e522896c02fcaead20d0c301653856e07b54c02145e1ffd3f7dfa10bb2897f43be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b9a3464bfe11d260de21feff7943d118

SHA1
dcd3414ff4e5dc8383274f903d43c7f11673d5b9

SHA256
d36184729c8ecbcf8b45b2d4604a7239b74d0085cfdf1b94011c9a017a57c36f

SHA512
73739127dc9c98cebde203e0fd418068f32a9f19072d27097f75fc04f0f0b6911cebad326ae55bac35da1416f81149a6a9a92fcbdba53e9ce14fbf353724d025

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b028935b49302818e75433e00fa26526

SHA1
97f031a2c70b18a5ffd38fc5118750c5a71e0130

SHA256
a639c593315bd6e9e53d9b2eb6f8a55ccb371ba2c4b003fee3836c0aadea3eb9

SHA512
d5c2121e83ec2f36fb4bc96583f8788ff3272e69c5092e2e19e07e599b736a36097cec53ac2f5b01410a72c69ab3087445e2f248d265ffeddff1e72af4c25fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b120d560b331d912e4918e3d0979f218

SHA1
50a0d2dcf9e6d25223bda412dd2b1fb68dcd31e0

SHA256
ddb6845d117ebca0e40ace63c2c7fcaf1de37733caf35391aa62b03771129084

SHA512
f0897bb689ec1a0ce0e7045e1f34a614f5de473fddbf6422e92b3fcc7842516ab79982a5ffa11ded55fd8e0fc786d069db8e39fa46bf0fd1f86748fce33344b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
826199687f7ab64b61f9d13cb10d555d

SHA1
21547f6c9b55a8b72c347d86f5fdd0710e8f65f6

SHA256
7185f41dff593cce698df0d93cf7ff85557fe1b4e0cd9c79cfad29226f914e08

SHA512
a7925c4e16ff70d021b57769a4b1dca9c6ccd058c63ed0727cfd472882df52eb5a5560bb1f2d174519fa8e141a5fef709d12ee3f6ae97a4d22686be5205f456e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f4f83dce54e5f3b3c763440cc3062e15

SHA1
ab149e7508968fea5f51ab241f8835e98f15154b

SHA256
e7d92321d5abc411657cd3bb1f242f433226e8b28a8827880931c711297c7daf

SHA512
211ef6476dd9d07c70be72edee6c2f8ef4ec5964acaa13816e1cc31a085a56ebbabe79c4f3248a1b6bbc0aa037858c004237e52c95ee9ec0537db22fa6bca3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2bbbdb35220e81614659f8e50e6b8a44

SHA1
7729a18e075646fb77eb7319e30d346552a6c9de

SHA256
73f853ad74a9ac44bc4edf5a6499d237c940c905d3d62ea617fbb58d5e92a8dd

SHA512
59c5c7c0fbe53fa34299395db6e671acfc224dee54c7e1e00b1ce3c8e4dfb308bf2d170dfdbdda9ca32b4ad0281cde7bd6ae08ea87544ea5324bcb94a631f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
42bf7e2716fde9be760723239fd1d076

SHA1
a46fc7eff6eb9fd306ea1c7920016d83a616435a

SHA256
7f86fe25c27be3965ddb0c50d7248bb11449bc6e899b2a02e13d0c7ecce233ad

SHA512
1787268cf3ba2aef9e8ea0c462176a771548528775af5494575d0c6ac6a1a50206ebf04e8100b281dc10cb9c50ef56370b6e1b6e6b0fe8f13dea4066a1b12f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
640fdcf3276d8bb5dcb2d2d284087d65

SHA1
597b8e16e86c1cd81555152e553a20124f2ca34d

SHA256
a0aef671bf3d59d60e720afa14df1c7aedd76c8c2706cd1a2a9f8465454e4497

SHA512
67c849c84c35b43396c452e0baf429b7dbfd94d1d42af6032bddd0024b61c5ceb70c5f83532e16e2e1e105b298410acb3c70d19a67db3649fb09429181d2a138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc6a.TMP

Filesize
1KB

MD5
a192507aeb0032a9479b50789cb461c4

SHA1
f566433086468ffd75530762b2f8d0fac91642ad

SHA256
0c31457998788ac08354d7d098b420d1125a7e38a27e848a43829b2acb5d45d7

SHA512
ca44a89b4a0f91295415a4c01f6b10ac5e7f7a6fb0dc1ea82ebc6b67120f72bd480ec555964441c90e9bd754c624949899838d3bf51cf3fe369df45934639d55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
84d4d0b1620169ec3affb629ae9b9d42

SHA1
2921ed000864a98b2e251bfca7860746d5753f95

SHA256
bb9e341f98aca81fa1810967d87e7de325ba62a3edc0353073588a2a46a49980

SHA512
bab20021139c5ea9d86cb25c2f50cd91e41a196307981af338c285fe2a69f0d82a1d074f1d09a07a763db958251af0996cdaaaafe75d5bec9f9bcdfc4fe1f7d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86df87be14317e9b898707b0a166a85c

SHA1
720ec6ba11ce99fa69f21998fc6cf86e999a31f0

SHA256
608ef00c3014a5f5bcf339d3e813069a12295fbf8e68a35adc250b98ee8d1ffa

SHA512
3676f0aad6239b690227678818f6b584f97ccffe40488ae3ac47c01dc01aee25bc9a0a252914beb7fe657580369daa90248aae85a0ce4523c4b276d47a86dae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
92c8be6f7a697e4bfdc16def5c80f1e1

SHA1
17bbf834d9b7e3b2fc05e91e826141aec6c7ce5d

SHA256
3b8ceb2162230272b95556c07eb37074a55b5d22787046021b213eb8a7db057c

SHA512
49180b986e03e73e703c65f5d86cdf0ec70132983b3abd1afd58024afa92d28ccbe9c9568929d9e56c780f4c4cfa31c177bba910a68d6ac41374af20d6b6d555

Download Submit
C:\Users\Admin\Downloads\UрdateInstаller.zip

Filesize
2KB

MD5
b5c52c0201d7f193068062822b377801

SHA1
ec512315e53d9cd2fcf53c0e55136917d92b66b5

SHA256
48cce7c844519ecb409c84e28d7d7b98b724584f66cada7c8f269df90da91760

SHA512
63e941d126006ee686c2f50d88541dd8ca670046187023ba0d0d5e26c2e80976b98b4ae08b1c084ad412ffe61f0d7e95fd21b48821b29035524e90c8613d9bdb

Download Submit
memory/3728-451-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-442-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-443-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-454-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-453-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-452-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-444-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-450-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-448-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download
memory/3728-449-0x000001DEB0610000-0x000001DEB0611000-memory.dmp

Filesize
4KB

Download