hxxps://docs[.]google[.]com/uc?export=download&id=1uunh1qD0bx4U21JO0SnbmuakQ9Qz5yTa

Resubmissions

06-03-2024 21:51

240306-1qkdasae39 1

06-03-2024 21:31

240306-1c7xfaaa22 10

Analysis

max time kernel
823s
max time network
847s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
06-03-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/uc?export=download&id=1uunh1qD0bx4U21JO0SnbmuakQ9Qz5yTa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-609813121-2907144057-1731107329-1000\{79406F4E-1C23-4D03-AC4F-588D879D2949}	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4444	msedge.exe
4444	msedge.exe
3660	identity_helper.exe
3660	identity_helper.exe
1880	msedge.exe
1880	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3844	powershell.exe
3844	powershell.exe
748	msedge.exe
748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	2820	7zG.exe
Token: 35	2820	7zG.exe
Token: SeSecurityPrivilege	2820	7zG.exe
Token: SeSecurityPrivilege	2820	7zG.exe
Token: SeDebugPrivilege	3844	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
2820	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3428	4444	msedge.exe	85
PID 4444 wrote to memory of 3428	4444	msedge.exe	85
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4388	4444	msedge.exe	87
PID 4444 wrote to memory of 4208	4444	msedge.exe	88
PID 4444 wrote to memory of 4208	4444	msedge.exe	88
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89
PID 4444 wrote to memory of 1608	4444	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/uc?export=download&id=1uunh1qD0bx4U21JO0SnbmuakQ9Qz5yTa
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa220546f8,0x7ffa22054708,0x7ffa22054718
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1820,5488130363024207553,12800756510593690676,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:932

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4276

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap20317:128:7zEvent27594
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\407b5874-e1fc-49be-8bdd-fbabb8a79d59.tmp

Filesize
12KB

MD5
e6d5a2af24820efe0b16367cd26d7848

SHA1
a1167f00dcdc972befc40b1862c9e74faea9f984

SHA256
2c46aa9fa906af3ac79ede8c6bfb2a163c70f1d848858e8ecbbd6eaeb79e4890

SHA512
557f790d1b50cf20125e97879dd986a08aaa361f5f36ab87caf3f33154f23d10d124a41a11d0b21b1b203c70f9747efc4e14daeb22386faf407c66ff048c30d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ce5c587a13e70dafd90b559da22a668c

SHA1
1ce95c1ba9fe7a389b7db2b278d84d998c62e142

SHA256
38515a181b998d8493d6a6c4e931649ffd20fd4aad3f208578f240d95e131176

SHA512
48e3374060cd5cb038b724a3bdbe3fef07baf0d00430f12c0210508731b04671899732d94adb6fcff6709b8ec2a263b040ed10e57eb22c7b143db4e1921a380b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
511B

MD5
de5b057ddc26c86a352b617634c4aefe

SHA1
9cb8f8953aa14c95ed1f95e8fd2041afd6152677

SHA256
4e9945f954c828a41ec489720b782f482b870fac56dc1841b9086884834d9a6f

SHA512
f32584a0f63549df1c5148c53216699f9fe9f5de814bdbf4c275969936581ba694ab8b4eede4b32b7a0642148fa45d3441ae848390a306e8c0375923d53c0807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
66fabeef379250d2e707bfa2b55c8693

SHA1
322ec76a541c193666b3c81f298704e2b71808fc

SHA256
894fdc04a17d1d74a56c0c9f09bbec2001638086fef3c9d4a7f969007576871f

SHA512
92d18bdc1432ff47e3f2f96c84959cb3b9c5455e5d02d538e0eb6cdac0a61d9d4f3497b9702894e524520554f69c11e6541964014950488b8856cb63498ec874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
951B

MD5
e98e3fb2c55fca8dc2c661dd60d456a4

SHA1
c5d4e657f15088aa88f392524d916709ff7830c4

SHA256
d2335384ecbc16c1d90c87b5c94f0336c20a0551f99423faf89d7fefbb6a83a4

SHA512
fb1ed20fd079964b57a01bf2f9f6828ea668cba4cb580b2418399842f336f5747c3446ce66c33b9ec95972afb4421dc124f207ed9e879d29a673a6244248d01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b82352eb42ef5244ece9e8917cb9243

SHA1
a95e38d327f6959369ced3c4c738da7d77d149c1

SHA256
24f218ef7b669ce76f9300ab5b54c87132f9b8dc7f61b29d4d01b2d254264873

SHA512
9476659847aff194449552d2099daf60447a1f9cec88359ba182ce75c3e03c4cd7415b316696e7f896c009aebb84542cdc247a71378fa72324ca511120796a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c027ccaa11be5310373c21c9d7606e6d

SHA1
6ca67fbb7c3948341a80a4f994745f9728990b90

SHA256
898099693d32146cb5769777bddae41442cb02dfee2179a7063ccf6175d86b85

SHA512
1c0bf7b0b95be8514edc0a53230668668f345d72dd6daa86fbdd22ecc77d5b918530980d6664620662b336ce784be851f4fedc2e7a72a564e566f1f4f7061049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba24e6db241ec3c08e08188c3ad8b4a9

SHA1
45b6baf8dcde8827dc27f00b31cb96fd0bd03d10

SHA256
878935967ecc4c5e575a6abacd8bf184af78dcd413ded60bbcf07eed6d9f33c0

SHA512
9fca5a22e048dd57fa182355fcacc37f60c854b9157292de5c5a3a997d255f270714abcd663664eff7610f04e50579f592aef9d64b25cea0c5e213adf98216c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e2ebdfd14b7c298076cb083c4e9f3f3

SHA1
07d64b80db4e715ecb1b67d699199b02bd9132d9

SHA256
b7e56bc68187ebcc1b2c7f21f7f5f9ff4d38d5236f9b4b6f1c276889f2fac587

SHA512
d04ab759b6f2215c63ec612d60434a979865cce039eadaa2a8c92e20e8c7a3d6e484da6e8728c43ce8bfe392c1685ec78cca8925481afc6aef1fd7ad53e87440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
cd69b8479319e10ded4a81162a36894c

SHA1
98f26551b9a545d5522cc58dd0bb491808cf94b9

SHA256
3410d30da84509044bde3509a4c99c5080e2d36ae1163e97bec81fc72ed51002

SHA512
bc65c381b2f2c9b3bce57fc6d7feef97512e640fdaf5b52889332d6ad3934521a469b3b8ce6b4e88a68f27281ca283ec4be93046474aef47370d5583723ccb50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e96a0.TMP

Filesize
204B

MD5
c5b3655c38545ef5afadbc58cba5d542

SHA1
d1f039040e0dc7e37659703df7c56ac76bcf8583

SHA256
1f964e1101198493b1d915254575613549eb83dbc5a830cbbdf6c27a8ad7f7f8

SHA512
39b7fa7f38088a9ee95e2d4973fe1d95766119c79506c726d30e70da47b9f7b8b62ae4beb0a04f959e0a659bac5c28e37ac083b85aed880b5f869a52741e7d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
6b6405ad4676fda1cc55e09f9ee05902

SHA1
6290bb783a66780ffd44328ec77c03ec007eddb4

SHA256
b46dea3087a5a343fcab44201d966dcdf7643605a44080246d5867287a466dbd

SHA512
d0cf09a5bcdedea57758e5424aab5f1cca6d445d3bf5e8974d055fdf8b4392327c04201de8de08cd23206115fb75e4ca8fbd4c1ecfcefc58ff8b5f31d2a5454d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1950f23fbfb73b8211eb5d9100563766

SHA1
f56e7037e22d3b622612afef9f5570839a32c2a0

SHA256
c40e64e65cb55ded749111b5cf0f0d49368d5ab3c005945e15d6858e15fb15e0

SHA512
8d8b7bff4639dd4e63857d29fc944e5c30589a8ee0fe2aac621a1501863fcee2c43c63b6d9b1051200cbf5e0c88b12bdee8ca53c49df757d1634d5c667f51054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
45afd0efffd25ae0adf412a3305aa290

SHA1
520b5d00478789530ee53d7c8b476ed89c59ad73

SHA256
7716ebbad749c8515eec9b5d06543ea3629b5388f12fa0b42f9b8353da26c2c2

SHA512
2ae197d75309a778cd04dffac4890cf14c35963e93d0d2a7d0fd41aa6221da212714e16202d51ea735cfc68839a2a013d0339afb49596fe5cdb92bbe2f771c32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f0b5b1808d90a50a6fc760ac2605ff0

SHA1
9408302b839ad672b843c1a28b88ae40827d5537

SHA256
2d82ffc3652089dcb4f957134b6d385420e77a80a24a11e32d702c7272a5c518

SHA512
47b258e0064fd836d438ae26fafe7c4045d02f482887ee7697ec585cff8f9f268bc24feae92fbb3fc21c6dc2b07a9b4072934d97264edccd19e012030ae529e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wk43tu51.1mj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Libro Y Registro Radicado Nª43197.cab

Filesize
594KB

MD5
697df287b1487c1802773c76efa7a42e

SHA1
1b8f2728452f84c2536adda4b82eb95b92807345

SHA256
ed591ee4766d048e0e1bbe93503d55a2b01911a2aa93f0a4a14354e07f1b2fb4

SHA512
411d5a61d21849175798d6e6a4a678bc53dbb20f927c5759f8ba75a85acfcb021c5355abcad19225614ca36fc1c537eb9156e27ef197e2bf44acda338675fdd9

Download Submit
C:\Users\Admin\Downloads\Libro Y Registro Radicado Nª43197.exe

Filesize
29.0MB

MD5
cd20630735c70bb0dade3d9ff525f234

SHA1
258c4913394ab88608b6107757e38cb6652f795c

SHA256
70fb91223ed7f4ea53e9b6f65aadfeee5bfc6a78f46bd937af31a41197dfd48d

SHA512
1016a7989cf8918f884196b711de202c868681faf882f6217fabed9d9242bbed332d45bcce9813eb8ffbb29f250484bb70ac608bf574128f410ce94c1818e8e5

Download Submit
memory/3844-207-0x0000025CF0350000-0x0000025CF0452000-memory.dmp

Filesize
1.0MB

Download
memory/3844-208-0x0000025CF0290000-0x0000025CF02D4000-memory.dmp

Filesize
272KB

Download
memory/3844-231-0x00007FFA0F4E0000-0x00007FFA0FFA1000-memory.dmp

Filesize
10.8MB

Download
memory/3844-232-0x0000025CEE740000-0x0000025CEE750000-memory.dmp

Filesize
64KB

Download
memory/3844-233-0x0000025CEE740000-0x0000025CEE750000-memory.dmp

Filesize
64KB

Download
memory/3844-209-0x0000025CF0650000-0x0000025CF06C6000-memory.dmp

Filesize
472KB

Download
memory/3844-192-0x0000025CEFE70000-0x0000025CEFEF2000-memory.dmp

Filesize
520KB

Download
memory/3844-228-0x0000025CF0260000-0x0000025CF027E000-memory.dmp

Filesize
120KB

Download
memory/3844-198-0x0000025CEFE40000-0x0000025CEFE62000-memory.dmp

Filesize
136KB

Download
memory/3844-203-0x0000025CEFE10000-0x0000025CEFE20000-memory.dmp

Filesize
64KB

Download
memory/3844-206-0x0000025CEE740000-0x0000025CEE750000-memory.dmp

Filesize
64KB

Download
memory/3844-205-0x0000025CEE740000-0x0000025CEE750000-memory.dmp

Filesize
64KB

Download
memory/3844-204-0x00007FFA0F4E0000-0x00007FFA0FFA1000-memory.dmp

Filesize
10.8MB

Download
memory/3844-457-0x0000025CEE740000-0x0000025CEE750000-memory.dmp

Filesize
64KB

Download
memory/3844-459-0x0000025CEE740000-0x0000025CEE750000-memory.dmp

Filesize
64KB

Download