Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
311s -
max time network
313s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 16:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/DecerZz/SynapseUI-For-Krampus/releases/tag/Release
Resource
win10v2004-20231215-en
General
-
Target
https://github.com/DecerZz/SynapseUI-For-Krampus/releases/tag/Release
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings Synapse UI WPF.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" Synapse UI WPF.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Synapse UI WPF.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Synapse UI WPF.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Synapse UI WPF.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell Synapse UI WPF.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 Synapse UI WPF.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Synapse UI WPF.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3791175113-1062217823-1177695025-1000\{FC83C530-14F5-4B71-8FD0-50D972727ED8} CefSharp.BrowserSubprocess.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" Synapse UI WPF.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Synapse UI WPF.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Synapse UI WPF.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2340 msedge.exe 2340 msedge.exe 3952 msedge.exe 3952 msedge.exe 4868 identity_helper.exe 4868 identity_helper.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 3600 msedge.exe 3600 msedge.exe 2220 Synapse UI WPF.exe 3360 CefSharp.BrowserSubprocess.exe 3360 CefSharp.BrowserSubprocess.exe 3360 CefSharp.BrowserSubprocess.exe 3360 CefSharp.BrowserSubprocess.exe 2484 CefSharp.BrowserSubprocess.exe 2484 CefSharp.BrowserSubprocess.exe 2484 CefSharp.BrowserSubprocess.exe 2484 CefSharp.BrowserSubprocess.exe 2220 Synapse UI WPF.exe 2220 Synapse UI WPF.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2220 Synapse UI WPF.exe Token: SeDebugPrivilege 3360 CefSharp.BrowserSubprocess.exe Token: SeDebugPrivilege 2484 CefSharp.BrowserSubprocess.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2220 Synapse UI WPF.exe 2220 Synapse UI WPF.exe 2220 Synapse UI WPF.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 3956 3952 msedge.exe 39 PID 3952 wrote to memory of 3956 3952 msedge.exe 39 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 4740 3952 msedge.exe 87 PID 3952 wrote to memory of 2340 3952 msedge.exe 88 PID 3952 wrote to memory of 2340 3952 msedge.exe 88 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89 PID 3952 wrote to memory of 1672 3952 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/DecerZz/SynapseUI-For-Krampus/releases/tag/Release1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb7ab246f8,0x7ffb7ab24708,0x7ffb7ab247182⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:12⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5952 /prefetch:82⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:3472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5948 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,5557661922812821958,5817003304615594954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3080 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2244
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4164
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:548
-
C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\Synapse UI WPF.exe"C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\Synapse UI WPF.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2220 -
C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --field-trial-handle=1316,4143267013382170005,15914244187479491553,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12821543248906906437 --lang=en-US --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --enable-system-flash=1 --cefsharpexitsub --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=12821543248906906437 --renderer-client-id=2 --mojo-platform-channel-handle=3572 /prefetch:1 --host-process-id=22202⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\CefSharp.BrowserSubprocess.exe" --type=gpu-process --field-trial-handle=1316,4143267013382170005,15914244187479491553,131072 --disable-features=VizDisplayCompositor --no-sandbox --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --lang=en-US --cefsharpexitsub --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\Downloads\SynapseUI-For-KrampusV1.0\UI\debug.log" --service-request-channel-token=7065606784565154345 --mojo-platform-channel-handle=3632 /prefetch:2 --host-process-id=22202⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bcaf436ee5fed204f08c14d7517436eb
SHA1637817252f1e2ab00275cd5b5a285a22980295ff
SHA256de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120
SHA5127e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD57c41f6bce212114af45494b69bc471e9
SHA19e210ad615843cf3f6d8691df04558d5b015f65d
SHA256dbf91cc3d3fc6e34a88406797f7ea31ca6194a4510111e8ce2788c5051458dca
SHA512508148baa2ec160371601fb2a31c74551706c8c4aa8b35484bfb815d1bcd61ffd811ac6d1f14bcbf5303bc1b983b883252e2fb7765702a048abde384ed7e0164
-
Filesize
496B
MD52ff4b0a28cbb1d79ad892d29eff5a289
SHA1610ad5f22ba0b14005becaf3fe50512ed011fde4
SHA2568684f55e8c85397e73ab1714db4ea03eacbd1299de8cd35bef22c687ea791785
SHA512f91f60d325396329c1b6bc944b317b2a0d67f92c9dab1dd91a114054b1674ede3adb28319acdeb6d254c3a51ab8b016afbc42bf7665015e8f70038ce77434189
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5e3f2f3f945059a9e61c61a93e121f72c
SHA1125a7fd855d47f18e41460377e79a31caaf79639
SHA256f99cfb0a65092015480364b68339cd25151fd680d3f04af4cc873d2f716631dc
SHA5125b173ef33b4de18f0728edd1073f1924542c081f606de33cc840fb1b04838cbaeaffc1a43384cee2835094d5bd6521e31858b3d08f49b7d2b12b973bf953a776
-
Filesize
5KB
MD535b574726884f27bf7a17ee885a9c1e8
SHA1b5b82908ed35e0dd645c31d3ecc50618174d6c1c
SHA256a9597006643e743b78b6afbfdd900ec51560013a8a9dd30b5b5c97808907251a
SHA512786f0af27e716967859e54e706364ddc6268c7a6f480fad3060cc125c751c7333aeb0eb735f61b6efc51bdff540461d0d5faf65acd97c64f183fb459c47978b3
-
Filesize
6KB
MD5ef300dfe1d2451169f5510e88771d93d
SHA15c7981df6469d22ff05631f53ce667a0b76fc2c1
SHA256fcf2110111b853b3f98b965cb0f4ea2e7ce50992720d9d3f908e5e4087a34b4e
SHA51241228b8c72e91472dcdf90fa76ca000fc35b3e3833d6fdb6337714584e3228f5311fc1502ff436bafe4d08da606ff1718fbc03795ba21358c3c68f81f978f98f
-
Filesize
5KB
MD5cb07d0e05557e10f100afd9531ee461a
SHA176598dc3ebbc5a7f6281cb683dd1cfe3e326019c
SHA256a705ed6075e6cacc9e999913eba36564eb28632ac1e6ce52713933ab84c29512
SHA512b27dab75ca19373db0f083f770f55ef9869fa95165c61d8b9f36dfcacd85de3958ad73a57a8b659ca0c85a53adb0193d7f3830937a2b8c6f1c30a80f23f336ed
-
Filesize
24KB
MD5b0ba6f0eee8f998b4d78bc4934f5fd17
SHA1589653d624de363d3e8869c169441b143c1f39ad
SHA2564b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f
SHA512e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9
-
Filesize
874B
MD55b793021ede1470d05d9370fe0ec4466
SHA10de7a5c0953148be0706ddf20d07251595542aa8
SHA256b6cb7d464a3f5e02ce34c43bbdd7ab4c45924e2216b578366212e38be9d7f7fd
SHA512bc2204e0cbbe7b6be28612735cdc04da82e1b8a8e562ffc20b3592fd12154aa5cd09380fdf588d3c0ee2a150525efaa0da53b9f82cd7af551f67d672197c388d
-
Filesize
874B
MD5e72dbe8a2c10f2f8d1dd76a72b098893
SHA1b033ad27e9300b08ff7207bc594d95ef82052974
SHA2568f5222598e3b851b161e37f4779f61f3dea43d9385e6613d8ac70449026f216c
SHA512bb1a6fad826f930d8c371920baa8af0c93548a1f167e92c8ed818035b04d33efe6c24c4bc97f2e91e4def4e0ff4202a0034fec572257360b347fe25ca80210a4
-
Filesize
875B
MD5673efcc9236b81fb036f87477aaab8c6
SHA1f60069a69f748e1829c1b85ab98f4c92a6bc6c11
SHA2564ab4552c545c64cf58b75e3eeb95547b2b0126f763acbb2740260d07a80acb92
SHA5128537dc76c61bb884329f316f4d09ff63b748dd92b0d06dad6bfa27ab86c620e5a3f205b39b44c2dc9cf31118f40c9464a20058f320be99d80a6316b25c4f1a77
-
Filesize
707B
MD56894fa4ee84050ad2a8a68792df23588
SHA16403909401838692a4383517b90684c33fe1776b
SHA2567f722774bbe76a17119f7ecf9a5fc4f59062ae0bf100a5c3a54859a10e4a701f
SHA512ee0273b49a4b2abd81cd0afa7c22e70f2540758c3ab2accef495b63cfad794b3381e218e6072445454c5f17798996e8260306435147954ae0681e9c0ff8c31ca
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD55de8d2f85e0689d7b812bd32468918a1
SHA164dea8a883909205645eea7442fabe42f095ecd4
SHA25684230d46331de1c069296248ba6431c2347714dbdc1f40fdc37f0cdb54c937b5
SHA512d3253b506ac62e24da6452a164b8e62cf265af1fd0099509d6a2d62e24ea429b31045ccecc687e1b4aa0773f0a4eb6ec927e16329dda3ca6880040a89098fada
-
Filesize
10KB
MD538f603ed7fe00e365da4caeb2a818fa7
SHA1a8aabab5c96b987b51cbe303ca95da1dd55521e0
SHA25657717c9c29c5a56d069bc32fdc605e9230b084333fd31216a66536c4c904e5b8
SHA5128bc73eb1eeff6b9987e1f4ce7810f35827276c0cc426280bd1e3e40e44b1b519839181616d5bd29315935e96a1d19fc8fdd7bf4c50bc67d334cb77fc2affe94c
-
Filesize
10KB
MD5e3b312a9cca1fb0e63102ec1f258f17a
SHA1fc24b630c9d5c8bfe6f9fb771ad997b1a73a2b66
SHA25663ae8e7f8ce384dfe9a2beffd21e1c71d9cfbde8ce0edda5b7427c0b558d2c10
SHA5122cd72507b027f416bb9e55eec5f36ce298a2a0d9f633712d24e4d83b298019df333e99af2b027cea63f270b347d114d996e3d13aed045ba680cb8a609a067f92