Analysis
-
max time kernel
73s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 17:45
Behavioral task
behavioral1
Sample
New Project Open For Bid IVP 278 (K) Series AI.pdf
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
New Project Open For Bid IVP 278 (K) Series AI.pdf
Resource
win10v2004-20231222-en
General
-
Target
New Project Open For Bid IVP 278 (K) Series AI.pdf
-
Size
107KB
-
MD5
676f3cd2213edb9ccba2eeeceff93b7e
-
SHA1
2691ebbd373c56c9bcd83a9650599ad6f284be3f
-
SHA256
054bac5f399d871b50c48563058a394e902cbc9d380e5ab278508460f6c68489
-
SHA512
b8fd3ea57349301064c66ebe3ba78ecca1720175f32b9a871b8446e40667e70a3da190f43236d3003bbba5ed6d1b3778022792ff3fc2b3016c6049f11a108b6c
-
SSDEEP
3072:3/QASq6oL9TeXRogwiw/Idxgru/CnnCUDZauj:Pmq6oMogwiQMxuwCnCu4C
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
AcroRd32.exemsedge.exemsedge.exeidentity_helper.exepid process 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 4056 msedge.exe 4056 msedge.exe 4680 msedge.exe 4680 msedge.exe 2868 identity_helper.exe 2868 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
AcroRd32.exemsedge.exepid process 3408 AcroRd32.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe 4680 msedge.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe 3408 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3408 wrote to memory of 4800 3408 AcroRd32.exe RdrCEF.exe PID 3408 wrote to memory of 4800 3408 AcroRd32.exe RdrCEF.exe PID 3408 wrote to memory of 4800 3408 AcroRd32.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 2900 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe PID 4800 wrote to memory of 624 4800 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\New Project Open For Bid IVP 278 (K) Series AI.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3632B822F7F98DB0E9BDDC5201C739C0 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2900
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EC0CA56AA9B80F4365992A2DD9990181 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EC0CA56AA9B80F4365992A2DD9990181 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:13⤵PID:624
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=30B5629F18CE9F4E7635AD02C2B0D6E9 --mojo-platform-channel-handle=2144 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:232
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B6BFBE3704FA12CA07D58165E6C06AD7 --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1740
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A7734AD4712146533C34CA224850EE6 --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3184
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=32CD942314AA9BAA9838F8ABF4E17939 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=32CD942314AA9BAA9838F8ABF4E17939 --renderer-client-id=8 --mojo-platform-channel-handle=2532 --allow-no-sandbox-job /prefetch:13⤵PID:2264
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/ewl2cOmozj2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4680 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93c8446f8,0x7ff93c844708,0x7ff93c8447183⤵PID:5060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:23⤵PID:4040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:83⤵PID:2964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4056 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:13⤵PID:2584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:13⤵PID:2336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:13⤵PID:2012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:13⤵PID:1800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:13⤵PID:2540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:13⤵PID:2996
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:83⤵PID:1092
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:13⤵PID:4524
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:13⤵PID:1560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:13⤵PID:468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13609790733776168525,14175642677829333178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:13⤵PID:3624
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1364
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5fec866c4ce0128735caade18ad9bdeff
SHA17734b7be6211d38414dc33c7a59d1c4f8d90e6d5
SHA256eec1d7a0a6f07f03dde6b9d2c7eba098c50bed49831a9eeb05c3298fce2eafab
SHA5121fc220ca9288e8b12a62c8aa0fb88912e8441b7724f45bea2fd0613a41495dd532f15075ac124ca2ac178cb1b4382da1251b394522f9146f969ca8de35d9dba7
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
152B
MD51386433ecc349475d39fb1e4f9e149a0
SHA1f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA256a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
SHA512fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
-
Filesize
5KB
MD5ca99318a956cb750b9ef296e64346cf6
SHA165233a3aea188d00105f778a5a513dd44be47453
SHA25648685379c7a1f0f3ee72046c8b05552aabe0c8d0147bb5cc0a4914951809be61
SHA512c707945fbe6e725d8310f4980c4638709af52977cb6259b1de7a5133e8297d4e317049b86e53946864a61110bb654f8fdd8488e576ddd436e6ca913088f439e3
-
Filesize
6KB
MD5c134013dcc36873602fbc938ddc1f9d5
SHA16e225c7ead181e5a7461b31d3471076fb89ea835
SHA2560f39972f87cca063b87fe41d4e2b864167ebd7cd6e9c67e68a2975638e96cbee
SHA512a564700c9cc841a86a924236f2fb2ccaaf2c59e3732fe59752df5f9a1dfa59c4301574b4164be01e5491e851d1a8fdcbaa41448f992545dda3ae8a2aae4ebfd5
-
Filesize
24KB
MD5e664066e3aa135f185ed1c194b9fa1f8
SHA1358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA25686e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
SHA51258710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c8b26e7dcac669bc20d332cd0cbaccbf
SHA1b016b8da0dd67523a69a78067e0098ccaf6032e7
SHA2569cb740636d65c50e92df53d1c6220169b19adf74ed7f021ab2d252f2f221ad36
SHA51250c758546d4bb69eab95beb4265d50113ecc61008ed2f90bb2cd3c1379975990365b35c0156ffa7a8b0726114d6e9a54b0fcbcb270ee2110423a0276dee9ed18
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e