94dc224f305782d593205438d916e9ee0ab41aa9522dc8bbc7c45900ec904cb6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cd039acb6a41c5f.html
Size 87KB
Sample240222-w3nt2aeb22
SHA256 94dc224f305782d593205438d916e9ee0ab41aa9522dc8bbc7c45900ec904cb6
MD5 1a6358ecd290e2a8fc16b8d711a9b8a6
SHA1 eb7486081eb08486c8ecbd9f9c37f2191c50e476
SHA512 cb3baad371f842528bc6fd66e97f45bdeee07f64d540c0b9f4dfda0805737d6d139365f01554023a32440383de5f85821c564ce84179eed628688c375b878f76
SSDEEP 1536:dz+ha9uJ6sPV9Ro/TdOkinYkBhrqkidhSco1r+Lkzl6Uvl4onz/VrnAv40TgXT/:N+sQ6eRo7oHBhrqkidhSco1r+LKLvl4U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4672	IDM1.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_ua.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_no.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\idmantypeinfo.tlb	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\tutor.chm	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\template.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_th.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_am.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_fi.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_it.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\IDMFType.dat	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.json	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_jp.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_kr.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_ar.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_id.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_pl.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_chn2.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_ar.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_ar.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_tr.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_vn.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_cz.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_tr.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\idmwfp.cat	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_al.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\idmmzcc7_64.dll	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_tr.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_my.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_vn.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_sr.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_fa.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_de.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\grabber.chm	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\idmftype.dll	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_hi.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_de.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_sk.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_nl.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_iw.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\license.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\IDMan.exe	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\idmtdi.inf	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_ge.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_ru.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_cht.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\idman.chm	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_fr.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_fr.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Toolbar\3d_small_3.bmp	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_cz.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\oldjsproxy.dll	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_pt.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_kr.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_vn.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\IDMOpExt.nex	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\tips_cht.txt	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\IDMVMPrs64.dll	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_pl.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\IDMNetMon.dll	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\inst_sk.lng	IDM1.tmp
File created	C:\Program Files (x86)\Internet Download Manager\Languages\idm_id.lng	IDM1.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
2512	msedge.exe
2512	msedge.exe
3512	identity_helper.exe
3512	identity_helper.exe
2708	msedge.exe
2708	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
4672	IDM1.tmp
4672	IDM1.tmp
4672	IDM1.tmp
4672	IDM1.tmp
4672	IDM1.tmp
4672	IDM1.tmp
4672	IDM1.tmp
4672	IDM1.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
460	idman642build3.exe
4672	IDM1.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 824	2512	msedge.exe	22
PID 2512 wrote to memory of 824	2512	msedge.exe	22
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3000	2512	msedge.exe	87
PID 2512 wrote to memory of 3216	2512	msedge.exe	88
PID 2512 wrote to memory of 3216	2512	msedge.exe	88
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89
PID 2512 wrote to memory of 3628	2512	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7cd039acb6a41c5f.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa2b046f8,0x7ffaa2b04708,0x7ffaa2b04718
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2436 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2076862232720272684,16737205803143743097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5052

C:\Users\Admin\AppData\Local\Temp\Temp1_IDM 6.42 build 3 Revised incl Patch [CrackingPatching].zip\idman642build3.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_IDM 6.42 build 3 Revised incl Patch [CrackingPatching].zip\idman642build3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:460
- C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
  "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 35947f71e9cd4bda79e78d028d025dff5fe99c07ea9c767e487ca45d33a5c770
MD5 1f6d41bf10dc1ec1ca4e14d350bbc0b1
SHA1 7a62b23dc3c19e16930b5108d209c4ec937d7dfb
SHA512 046d6c2193a89f4b1b7f932730a0fc72e9fc95fbdb5514435a3e2a73415a105e4f6fa7d536ae6b24638a6aa97beb5c8777e03f597bb4bc928fa8b364b7192a13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7f55f63c6b77511999eee973415c1f313f81bc0533a36b041820dd4e84f9879b
MD5 4254f7a8438af12de575e00b22651d6c
SHA1 a3c7bde09221129451a7bb42c1707f64b178e573
SHA512 e6a3244139cd6e09cef7dab531bff674847c7ca77218bd1f971aa9bf733a253ac311571b8d6a3fe13e13da4f506fec413f3b345a3429e09d7ceb821a7017ec70
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 2dfd4d2b37de2d5cd36ef103630366d192fc5dc78f53ebb9c432737b0c992457
MD5 de374972a6b26fd3ab4d78d88a42de74
SHA1 cb17ec71c4d9e877c9115e5588deddfb2c2819ca
SHA512 52f929347821790c893fd0cbb2770b1cba3962b01b4859d6aabfced0427ed3c90f5e910f645dda99bf5812e11bf1e6f9fd834ced6f0b8ecd5e34ca05e7a5a7cd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9dc86c36e4e4c554c15db7524fa85b2dcecba4c77908798012c9915b492aae82
MD5 99b3b8f88fba8143a64c5ffccb70dadf
SHA1 612bca830321a08a4d7ed072bc45cfe53f07db93
SHA512 431664d78f9dc8da95502af71b2a9eb00b753d464ff60b88f7f9ac9bf007401b56275a73f659009e4fde5c3cc0967b8d32183bfd0815bf2f750ded0b309f54db
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a136dbc197698bfcdcf96d1fe32234c6218d8a9d10dce7b1f920e0ce0abaef26
MD5 7b7fb00c0ce6e260fa1e202972cb2ecb
SHA1 365485de637bf0ced9dab94e768e04d488c1692b
SHA512 2ff234ebe29087da48a83f6b4affc01f740cb541dcef3ecd98f117e8e534a817510577add845d7c43ee0e45b10bfae4567b044ae5236c5064010c80255407995
SSDEEP 96:nekPSxm/FDmq51MmuxwpF469WMoi7R5mdexf52lDhfuMvNjUWQyV+VD7AiEwb:nekPPUSSni469WM7nf52ltmMvNjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e2a190e00480ab497dd04357191afb796fb4a2bba106266e16d5903922beb589
MD5 2f8c1546d859afdd9f8eef8302add29a
SHA1 be5abfce8d46c3b8864843353ee0240220a0d345
SHA512 4c69dad1c720c09aa2bbf8719115b70873643706316ca4b69b11a6fe10e733715acc9a23da0c1836917c8e25f37d71c79ae6d9114659cb37f40c1026a8dfe751
SSDEEP 96:nekPSxm/FQYmq51IduxwpvWMoiVmdeHlDhfuMvNjUWQyV+VD7ziEwb:nekPPOSyGGWMXltmMvNjrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ce71f6a7a8be50adcdb3f68216d392824677335a55ceefe50137e77cec05318f
MD5 7cd118d82bd1a82f458d9dfe604f7df7
SHA1 049f0380405a43d187b7611a9c65084dcbe308f2
SHA512 5d7377721a2959f4ebd2d51e7ede0d5a8c3b4fec3725d9224700fce748895f642191bb11a58ac17d14e3add96e58ef7336ce87ef4d41d7501fc9b9c3ae6d4364
SSDEEP 96:nek8sQFSxm/FDmq51MmuxwpF469WMoi7RrR5mdexf52lDhfuMvNjUWQyV+VD7Aih:nekwPUSSni469WM7Vnf52ltmMvNjrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 557ddf010ec05dd9548719b1fe61363d651c4dd1134375b478253f543647ff53
MD5 07b269bd4443b8a16eee23110e3c7346
SHA1 05ca24d09a451a8823e70b0c499d0e14132481ae
SHA512 96948af014fb042e2cc83209429540ea6edb78f53ab329d41123ea9f21c22553b80954dc514cba149554e90a0cfc3cf2e0285016bdec3b95bb2ef6ef4300eaa6
SSDEEP 384:A9iIxuERzA83h09RZxYKr6fwg/da9E1MeuBOLz3F:rIxuERzA83h09RZxVg1aTOPV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 36517cac28cf680d24de7395b69bc265b5f1e31ffaab91f6e419f8a546abf344
MD5 fee5dc578c5f64201bc43e95fea8bb06
SHA1 48dd036ffcc684702e538ed4992b9fa5ac253048
SHA512 ae5b0d90fbd13bcc63d7757420613fd8a50c2a083b23f8acc014ec82ef13eea8b5050fbc505a8974bff267edbf44e48e8718cf147329619094e60c6fc362a301
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup07ANfe2RUAwSnWbCz9xUX/:A9iIxuERzA83h09RZxYKsfwcdz9E1Met
MD5 SHA1 SHA512 SSDEEP

Submit Download

IDM1.tmp

Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
Size 162KB
SHA256 ab22a282915750e9d07ddbe300a7d4a3b23b69074a0311a1a5ba4fa2bea48e7f
MD5 b9be2bb9b8141b80903cc2fe83bfe30b
SHA1 5e03b00a3d601717a47d90dec8ab20ae2dbd2f45
SHA512 8727fc335cd1750d36889f08d2b12489b6382c668edcbcb1224e6cf0b50b6ec5caf1801e1ccf09593863cd5f48556f8faafd7955fe8553d60176ab0814e83a3b
SSDEEP 3072:KftjHJwviCrFTWQC1gX7ouW5Kt5ApsTTDs:m7JwviCZ41gYIt5ApP
MD5 SHA1 SHA512 SSDEEP

Submit Download

IDMSetup2.log

Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
Size 354B
SHA256 9e204b604538ddc273eb7ac2ebcc92add539ae01d228d055ce99d4a08370fbd4
MD5 4c1528dc716bdcc77f5351d94a512c95
SHA1 aab105993ed2cc2aeb72fb0f9bf923047c8ddf19
SHA512 cf57b84a7a18310a76ef17db3f67ae827d9de5c011100d3dad0710e6a1b3b95e0015e235a3c7d6e029fd642f359a4c81f5d11c62270dbe4ef58f7317bc9aaada
MD5 SHA1 SHA512

Submit Download

IDMSetup2.log

Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
Size 1KB
SHA256 9f1b98d0dcb6474707ddb88e7c80e765baae4e5cdc258e985f7c6a22aef1ae9d
MD5 2fa5aa35cb57267d941fe3ff717cbd80
SHA1 c6372870241b20ce87cd59297d53b48b59670414
SHA512 1fbafb6cdcf0d5388b7d160435f3b0588d729052b1abdfa4d673279701537fb8dae7a308de173112ee32cfa5a4cbeba170c1f95b9715c7eab14467422ae16b9d
MD5 SHA1 SHA512

Submit Download

IDMSetup2.log

Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
Size 1KB
SHA256 906ef3e99ebaa80f2c2a96cbdb7aacff84f18837679029bfd3ae46e73b485130
MD5 15ba992bfe7eaa246ea196ba76f71217
SHA1 44917e8c73c2062472ebe282002c56db2e885a4e
SHA512 0dfbecb067fc94ad4a115719a8367362425008b4da19a8831726373b778676d985818a56c9bff5df471bd69833be4203c7ca76d81c43f2d5d0c62870cdfec30e
MD5 SHA1 SHA512

Submit Download

IDMSetup2.log

Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
Size 2KB
SHA256 0a57569af7367646154316ea7e836bd97f6ba0eb1ef11f7f1e170d0fd4a1ed8e
MD5 4b7d3151e355029bbfecaf317fa65e00
SHA1 2e474e539885397a5e2279dbe009ae0054fcf738
SHA512 b770ad652bd934a0ee0ca596bc9700d856d959216c32c4df58295f7d858fb797835233a9b4524cee9aee1004427507d8ddea6bda7dc949c016105a768df29484
MD5 SHA1 SHA512

Submit Download

IDMSetup2.log

Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
Size 3KB
SHA256 c6b4eed0cc8f2898a89aa0c00e386c5285e408aa228c2bc0bd5397d49b86618a
MD5 de1aeb1fce15272e7234e0e743af3837
SHA1 4db1d125582f11938978ccf86a59a2d7f019dfdb
SHA512 75d1e540f15a72e026497474618ebb928692d2a43780b4874dd88ed5b4cc97b6236709039a66b711c92ffeca37e52995be40c0430dbe9b1fefe1b8f1202719df
MD5 SHA1 SHA512

Submit Download

IDMSetup2.log

Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
Size 4KB
SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
MD5 95603374b9eb7270e9e6beca6f474427
SHA1 2448e71bcdf4fdbe42558745a62f25ed0007ce62
SHA512 d3987f207ad05e142d864b3ffe4ff6758d22b56f75d60ebcd79e0c760cf27106d7ff74bfbc7569389710e50602d3359b4ab20ddc14fbafcf526478dc85bfe593
SSDEEP 96:XR/xR/VhxR/KR/XR/cR/OR/yR/qR/XR/LR/9R/M/R/MSR/WR/JR/hR/MQtR/MQRJ:hv9hyZoG6SJNriJ+X/1PoirCEZElE/EM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 120203.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 120203.crdownload
Size 1.1MB
SHA256 1fe67c5ed39a033c612280b3c5747496c9442dde6b5ac2ab3491cf3ea2f8bd97
MD5 61e8cff5799060500432ff53c0ba2d9c
SHA1 415acff650e8f9b6c99022d5b66ed5187381f8e3
SHA512 edda9c7630c3149dd616a307fe8671f63e1e3b39c0e1b14cf45724067f39c20e7771996a79531344437eb9d80ceadc2b985d886840aa7c7384c94f3dbbd1274a
SSDEEP 24576:ePHOsnJnnGWx62PpXrjf17R4pfiMRhFkYs+lkbsL5oxe:IHz0QvP5rjNIi6hTC++I
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/460-244-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/460-241-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/460-240-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4672-243-0x0000000000400000-0x000000000042B000-memory.dmp

Download