hxxp://youtube[.]com

max time kernel
279s
max time network
297s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://youtube.com

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	POWERPNT.EXE
Key created	\Registry\User\S-1-5-21-3852399462-405385529-394778097-1000_Classes\NotificationData	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616193"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	POWERPNT.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5280	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4948	msedge.exe
4948	msedge.exe
2108	identity_helper.exe
2108	identity_helper.exe
4892	msedge.exe
4892	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5280	POWERPNT.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5280	POWERPNT.EXE
Token: SeCreatePagefilePrivilege	5280	POWERPNT.EXE
Token: SeShutdownPrivilege	5280	POWERPNT.EXE
Token: SeCreatePagefilePrivilege	5280	POWERPNT.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE
5280	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4196	4948	msedge.exe	56
PID 4948 wrote to memory of 4196	4948	msedge.exe	56
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 452	4948	msedge.exe	82
PID 4948 wrote to memory of 4148	4948	msedge.exe	83
PID 4948 wrote to memory of 4148	4948	msedge.exe	83
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84
PID 4948 wrote to memory of 3232	4948	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://youtube.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbff663cb8,0x7ffbff663cc8,0x7ffbff663cd8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1860 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,10802614349333237384,11170789527549678069,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4996

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Desktop\LockClose.potx"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
341f6b71eb8fcb1e52a749a673b2819c

SHA1
6c81b6acb3ce5f64180cb58a6aae927b882f4109

SHA256
57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

SHA512
57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
88e9aaca62aa2aed293699f139d7e7e1

SHA1
09d9ccfbdff9680366291d5d1bc311b0b56a05e9

SHA256
27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

SHA512
d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
4d2886b93efc31cdaf323535f344ddbd

SHA1
466118cc6964d2b93acbbac1863fe6b5b28695d7

SHA256
c200294d03dc6157c8e1ed2b83f3930d2c004f458dd59ba93eff1cc6b785b4c6

SHA512
289660538951b1329f6d47303189ef5619fbff28bd9d43bf920542cd1e819118caf125f7a430004edbdbe81538910095543785b7285eec258316429d030e3ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a2ed54e5eacb01953220240eacdce481

SHA1
5b47c5c0570beda10eaacda2419bcf65d2c1df65

SHA256
d75343f492e7141cca405c4b6ecdf4d64c431ddcd59de59eee2a269d5c53bfa0

SHA512
347785f2c1e4b4cc2f11fac81744dd5dfcda4295176d4eb5a8c329228f2785b22ad3f67025d0f195f7b091fce5f27c8f9cf98156d58fd80045863a8a6f771dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c2cf5754b42a73923793d6299b10cafb

SHA1
a8ba34eb7d967c4db997d7850680598c3e52c021

SHA256
2d272f0d7c15b1c785417d31c4dfcce8da8493d6f2a4010801d33f78e42bfb71

SHA512
53ce7b36ef060c3b50c48ba3873eea54ab6f00a25ff3f9c1a38e4f0e5a0188f63a6da1017632793763e9baff5f735681a957f203ef21a3a5ea9267ad53c784f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6ec094e6c0ac177bf77a0fdd023044b

SHA1
009a8dde1c15341a2a93375f736fb208eb38a4ef

SHA256
4effcfa8f0ce63f7ee771e09f69cca093f0569826e04a79563e3071c0878340b

SHA512
2fd4acd2d8cd89e96b535e19ad544d3d55065bcf93cee94bff0460e347cec21c143df01a3d1dcab9a422099f29a89019e37501a70150f881a43676c0aa5f1e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5aa6084fc60769487bb1440ca1d12e5c

SHA1
8ed06f788d14f94738c2548ba8d6493847475cb4

SHA256
49ec22ceaaddea497778b75119e92e1745657358773fc02562b0c3be7a747df3

SHA512
60388b178007e3e852c31501cc7825f2857abb1764fae0e2d907da0dc92fd862d89a393039c1dfab68bd34c8633910ffd18ee578e2083e1214079cf01c70f4a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01f1fa0582ab71d6507c508c79d66827

SHA1
07bbfa4f840750581ac39a70a17c7e6f65ff4d9b

SHA256
f24b92b92285c21ff1d28333075a3c7374cd79dbe3f8c0d804856d953cf17f67

SHA512
4929e79b946f3bde742fe3a63c6f1b9b5aa8cb0ea186abd1012ebca697bf92df921b90baeaa1450445c80bd7ba0e3507f427b6368befa5d66bd0d7bc39b96520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\801a6e19-4365-4168-8ca1-1bb3c316ec52\index-dir\the-real-index

Filesize
2KB

MD5
86f75c9ccd4b34d08cfb1522831d0b2f

SHA1
c82f8891e9725afe5a24ad95646b36769fb121ce

SHA256
69005664558d664025002ed782b49e4b82f54e6cee4c801d063282a813dc95c7

SHA512
d2037123232aba258525a14a64b9a4317f1cc3199529ca9a6c56538a0c4961ab5f42a8676763742ee8a20e701fa76c4bd02a93a5520e18c82d358bdf82d16058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\801a6e19-4365-4168-8ca1-1bb3c316ec52\index-dir\the-real-index~RFe586b67.TMP

Filesize
48B

MD5
9fbe2785f681cba4944436a8ce51c615

SHA1
ce0d034e4a23b7bc4f504daa2239629e8548e1fb

SHA256
2f495920dde71b9807015480b15ef6392d0b3feb6a4b0e96fab7378d11ab8c1d

SHA512
b664251a48d64925c8522d0157a51dff4da9ca4ce1820603b870fc4a4edcdef696e805ef54b476107355c94d4e40b4ce2f74b8aa5757e71f6d5b8bb94b652b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
2f4fcb2d93b7bf789d030c453d261dad

SHA1
9dc37d577e94d9efdd87ee7bc7bc41222be96621

SHA256
c88fe7530c62fe70f5fee969e13139e7b25062b1307264adf2d9fce11d3ab43f

SHA512
b9f5df022c9ed294e1b4e42b8f30dfd5771db30769f0cd1f87fd767e63f3700b4593620c8c77b99135164ef12f4d5a869b53a21681903c3a46566f26e15da67d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
caa16b1701f0b5a64f42e00863a6b2fc

SHA1
dd0c3d526b1a1944e02d2bdcd76784513a2e761e

SHA256
c371a7d6bde0131ef43d5b375c1b54f159bf284df8a5ddddac8797045eb671ae

SHA512
5d3f78edaa981c76a5a00b4cc941db9ca23785eb7bcb1dab00af6afc11a6f2d8289f9408aab8ec7eb3413c697df7b2646a9b022634d0d7a2332b32c33fa8d222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
c3cd1a063a77d76a888a401847864397

SHA1
b909faad630ac12a3dbcffa1c06016b4597d43f5

SHA256
fd42dccbc14e6e39ae323f5f3ab5278165cc752cfc3757bdec2abbc7afbb0588

SHA512
c29981d6ff230645f6f068aa6558fa04082ed8be381a6ea7795d30f19a66dcd452a1d69df7c406f75832e8ca465fc2b022092369fac7ceead920c9d9e703c496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
189ab7522b7280089adc0d12b8d01ca4

SHA1
68858b53afd9e3816429bc2770e7e26c5bb0aab7

SHA256
6024d1eb0142d9bf9de2b52347bd7427b04f7fdcdda4c4b3f493a15e82cf5854

SHA512
55b49f75de959660f0813ebeee12ebd0be54c02f116c1159b0fb29bc57178c1ff7baf2cd3b965bc310229a6a1333d9f4c6fb7f0663cbf77dc3cf8e619de49d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
8cbbc86591371fde15f06ee0485c2b13

SHA1
7b6f82a6e08632ac992dfb8d3395513e952e203f

SHA256
a692c76906540028b0c25c16c0ea11979390c520f057e2be57d5c06fba60f9cb

SHA512
33cc2969eeccc1738958947a31586de3573695eb239f9f3bbef221a7ac81f5a5ca88ee343b0875152e080e158ca46e211ca3fca3a1ab67d223bdfbf28ae28ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4ae7cc468f249c7f16239a5fc445c6ee

SHA1
44d09bc3c3c56ca1d3e2fca6337f712dd3c8e5e8

SHA256
5be01790e600ae70bb1c81b34b6f14e4f32e2adf5637fa48498559d61bf8ff0f

SHA512
bf7c621f8acb955f3c2b40538890cef3898dfa329d78cdd8f07041126e0b75d3449308e472415ef5a7ccf3c05af67c57c2b3ee60c007e58babee732bddc753c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
303b94405af492967ec7f7ccc71307a5

SHA1
6fe0b000f984856496d728bbd1aa2b665e4ff05d

SHA256
b7ecdd1cd0a52ac6ed5f9e45c036ca13f0395dbeeb8274899526e7089d1ed3de

SHA512
76c15c85a5a9d2f3bec223f9680087358196694138c9e4988651b6b9aa9a61346e310052cec83e8ed3b45e29163525291123f968e17255323d13330730068d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584457.TMP

Filesize
706B

MD5
64675bbb43fa2fa9b706dada42faf5f1

SHA1
48bd7ef6a35704e890548b55bf2d556f1bcaf6e4

SHA256
7fc9c3927050364af7957b11c016cce9d25798427e59450e8fb811ac449553f7

SHA512
a654a641b23da471c286560050912ff3d8af40ebfabc656f9feddc35a4f4e57ff2c57bc1655fffa4d05bf964135d79a232909f615b1049f54d80e8b8e13896cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
165642eeb22cdbd266e7e75c1650e2f0

SHA1
53bd1aa40872f64c5fb619a34a1a49246dff8b61

SHA256
f8edb09990f25ea1715496ea48b199441a51a5b3cda9131ec1177144e34c5615

SHA512
dfd5b31a56d425efa84c993230539b7f5c5592b28cef645ed937ff99aa4923b2679c72ea3cc33f7d49922115f8790b0675e9b4f83345cfad0b597d222483362b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bbb770778dad92760d12f85fb0a2df45

SHA1
1bc2e3906bde8936ef76b6276ac2a02b1d843968

SHA256
303baf1b80e20201cbe2a7c9ab9470d102c0e5512c77d52f42b015457b87896b

SHA512
162abc1d8344cf021ddd439003ad07e9bcb3eb5246386f89939c2ef1d849d55bc392a57f5ae16bf43b2e037c90576dc5f873194ef358c8bd942e8c0e678dbf08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
f03b0fe6c6d7a6962178351e0187f29a

SHA1
b7699752e3e7151a1ae8bbf2ee41555ab816f6cb

SHA256
538aa8f3ca2d4487a3e17346b58d2d2880ad038549096e8c4f3d7c65ce189d32

SHA512
8e8242239c68423f9856e01a2d5c9e2f3daad2e5343159a06d92b9a098b66e47904374d6640c824f3073e52edafd64baf6c0eee68dc78c26ba29cfc9cdfe07d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/5280-342-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-343-0x00007FFBCDF30000-0x00007FFBCDF40000-memory.dmp

Filesize
64KB

Download
memory/5280-341-0x00007FFBCDF30000-0x00007FFBCDF40000-memory.dmp

Filesize
64KB

Download
memory/5280-348-0x00007FFBCDF30000-0x00007FFBCDF40000-memory.dmp

Filesize
64KB

Download
memory/5280-349-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-347-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-351-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-350-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-352-0x00007FFBCB390000-0x00007FFBCB3A0000-memory.dmp

Filesize
64KB

Download
memory/5280-353-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-354-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-355-0x00007FFC0D400000-0x00007FFC0D4BD000-memory.dmp

Filesize
756KB

Download
memory/5280-356-0x00007FFBCB390000-0x00007FFBCB3A0000-memory.dmp

Filesize
64KB

Download
memory/5280-345-0x00007FFBCDF30000-0x00007FFBCDF40000-memory.dmp

Filesize
64KB

Download
memory/5280-346-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-401-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-402-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-403-0x00007FFC0D400000-0x00007FFC0D4BD000-memory.dmp

Filesize
756KB

Download
memory/5280-344-0x00007FFC0DEA0000-0x00007FFC0E0A9000-memory.dmp

Filesize
2.0MB

Download
memory/5280-340-0x00007FFBCDF30000-0x00007FFBCDF40000-memory.dmp

Filesize
64KB

Download
memory/5280-445-0x0000020338E70000-0x0000020338F2A000-memory.dmp

Filesize
744KB

Download
memory/5280-451-0x0000020338E70000-0x0000020338F2A000-memory.dmp

Filesize
744KB

Download