d9313d8b5df341b4c1178fba770a7fd56819aeca7d56ee01f86d7861635f108f

Resubmissions

12/03/2024, 08:13

240312-j4mxxaec84 3

12/03/2024, 08:10

240312-j2q7jscd2y 6

12/03/2024, 08:09

240312-j2cn6acc9y 1

Analysis

max time kernel
144s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
12/03/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bandit_R6S.png
Size

194KB
MD5

3e8f2ad9cfabe7114ba0653233590690
SHA1

ef502bd77f17b24bdfb86b6a692a07e7783ac431
SHA256

d9313d8b5df341b4c1178fba770a7fd56819aeca7d56ee01f86d7861635f108f
SHA512

c863b3bd80bbe93227e34963eef484708308b3ca205ff32ca83140cb0e0f311bdf7bb64b5dcae3e29d6e73ad1c535fc20fdb3ed4281c9bd35c60fdc443833fd4
SSDEEP

3072:VDDYNAMbdd9NH0rbfMI9qdvszHpLQ1/7L2HUKiNv2h520oHRSeGkoaKIV7alpM53:iNpX9NHK0I7zQ/NNvS52UeDFO+IjI

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
17	discord.com
67	discord.com
68	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1101742937-4171729779-750941522-1000\{86D58BD4-E46F-45EE-8EBB-A90C3FB6427A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2368	msedge.exe
2368	msedge.exe
5352	msedge.exe
5352	msedge.exe
5716	identity_helper.exe
5716	identity_helper.exe
5256	msedge.exe
5256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	firefox.exe
Token: SeDebugPrivilege	2364	firefox.exe
Token: SeDebugPrivilege	2364	firefox.exe
Token: SeDebugPrivilege	2364	firefox.exe
Token: SeDebugPrivilege	2364	firefox.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2364	firefox.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2364	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 1676 wrote to memory of 2364	1676	firefox.exe	85
PID 2364 wrote to memory of 4332	2364	firefox.exe	86
PID 2364 wrote to memory of 4332	2364	firefox.exe	86
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 1500	2364	firefox.exe	87
PID 2364 wrote to memory of 2116	2364	firefox.exe	88
PID 2364 wrote to memory of 2116	2364	firefox.exe	88
PID 2364 wrote to memory of 2116	2364	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Bandit_R6S.png
1⤵
PID:3700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.0.335868923\559834913" -parentBuildID 20221007134813 -prefsHandle 1796 -prefMapHandle 1788 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b8ef28-565a-4128-bb0b-99ef8e55ba13} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 1888 181c09f9258 gpu
    3⤵
    PID:4332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.1.366886228\1688917591" -parentBuildID 20221007134813 -prefsHandle 2252 -prefMapHandle 2248 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b615bde6-5a00-42eb-9ab4-c09c7a757832} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2264 181c0906e58 socket
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.2.1351270541\2059634714" -childID 1 -isForBrowser -prefsHandle 2864 -prefMapHandle 2880 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa749015-00e1-4b93-99de-15a16400d092} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2856 181c4deb558 tab
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.3.1844224721\1722354677" -childID 2 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e77669b5-9151-4f01-922c-750c1452d32a} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3348 181c5898058 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.4.575876738\1289377583" -childID 3 -isForBrowser -prefsHandle 3484 -prefMapHandle 3488 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e638b5c-cfe6-4126-8d41-c9060d493ff5} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3472 181c5898658 tab
    3⤵
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.5.712099932\764151526" -childID 4 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3be2381-e0bc-442e-b7a4-b79ddffa7f9f} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3684 181c5896b58 tab
    3⤵
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.6.7678912\2086120793" -childID 5 -isForBrowser -prefsHandle 4160 -prefMapHandle 4156 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8822386-d392-4bcf-80f5-92a62bb9b0e2} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 4172 181b4962b58 tab
    3⤵
    PID:5104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.7.265969256\1622464648" -childID 6 -isForBrowser -prefsHandle 5252 -prefMapHandle 5340 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1d0eba6-7970-4045-8c98-ac6f81a45b67} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 4544 181c7be6058 tab
    3⤵
    PID:2164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.8.413706878\177988766" -childID 7 -isForBrowser -prefsHandle 5376 -prefMapHandle 5484 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78cb336f-f30d-4be7-ac82-cf1a7899a4a1} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2860 181c2203858 tab
    3⤵
    PID:2584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.9.897162130\1468023906" -childID 8 -isForBrowser -prefsHandle 3620 -prefMapHandle 3632 -prefsLen 26723 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ea05d22-6eb4-4a2f-8088-38786a0117ed} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3596 181c7be6358 tab
    3⤵
    PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff881153cb8,0x7ff881153cc8,0x7ff881153cd8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4032 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
601fbcb77ed9464402ad83ed36803fd1

SHA1
9a34f45553356ec48b03c4d2b2aa089b44c6532d

SHA256
09d069799186ae736e216ab7e4ecdd980c6b202121b47636f2d0dd0dd4cc9e15

SHA512
c1cb610c25effb19b1c69ddca07f470e785fd329ad4adda90fbccaec180f1cf0be796e5628a30d0af256f5c3dc81d2331603cf8269f038c33b20dbf788406220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a91469041c09ba8e6c92487f02ca8040

SHA1
7207eded6577ec8dc3962cd5c3b093d194317ea1

SHA256
0fef2b2f8cd3ef7aca4d2480c0a65ed4c2456f7033267aa41df7124061c7d28f

SHA512
b620a381ff679ef45ae7ff8899c59b9e5f1c1a4bdcab1af54af2ea410025ed6bdab9272cc342ac3cb18913bc6f7f8156c95e0e0615219d1981a68922ce34230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68713c370971ec3d8629ab2b90382cf9

SHA1
a622cd34e486a3dd6f8db835a078d68b71f97184

SHA256
291808bf2a18fad69af307421c692d3a77d4b2ef5f9ad28edf54b77e67347be8

SHA512
b36dcc35dad8120c29e13d31a091c90ff77d2f1ad1e2bfc9d14fc2eed7cb3e295694bda6f5c7392696101c7c4bef78c99319b10e4510859040908b159f2224c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29a096744c201583f2c832fe159e9dd9

SHA1
b3e7d3147137642b5ae4e97a78f6799d63d9f64c

SHA256
886f44ecdb82c5835b891e4ddc09feaa891e9bd9957c9dcb53da547810318548

SHA512
28358fe926d709314d58a185afa3dd3eafd52084cafca7874f51e1079c9054b2cc15a1bc9552913034dc0ee063f84cfe8c07a6e46b8dd5816a54801927df31cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ef08fce86f0b470d97f3c87624f7396

SHA1
9dbdd39731d2554fbc245bdda78fb741bab0df55

SHA256
949460fa4425fa3f00433bb6f5588cbefd17849cf97e180f5db14c43160062fc

SHA512
7c872126118dbf6995de063861a79e7d5d5a15c2e35028638819fc5e398eee483f29025c59bdaaf281eeda5ea5e9b2fb33a5ab1d46a2d39a4de051ee1853496c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\doomed\28305

Filesize
9KB

MD5
3f1fc0b11b9f879f2b187eb525ba12ed

SHA1
5b94f609b6a58cdc8aa049dfe739868e2ce36c87

SHA256
5aec29baa7af2100ea8bb12298b98592e1a42fcd42560f44b3219191f129f517

SHA512
6c92f4c45a7e676b68b3c68419e932cb87496bd31c03f73d4a9d34dd9fe768804099194e426699d34a40b4bf637c57c8cd974d5fe912c06bac94ee6614e6e805

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\45514F58EE166DE19E4DE720A21DDF1DA12F6C6C

Filesize
203KB

MD5
5efed4b837d68d06a320c95314ad65b5

SHA1
f71a96dca2c77ec91a44c9c531fdb187184466a5

SHA256
703bba1257e1e71f743d29f7be23eebd9c76057646f904e0a5ba3404d0343085

SHA512
0586cef9d659850fdbd70299fad67e89ce997c237bf52916bb37888644756a66dc1d83b99ff85e4505f7e34f9723a201dabc03e94e344e342c626c6d8a8007d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\4E0C28FF25B34AA6D81276C14EFAA147A7403E02

Filesize
22KB

MD5
507d4b83a7e907897b38da8f2a213a00

SHA1
232535a48bae919285a3a174f7cee87bca7027e5

SHA256
982a7786474226c5e6a0d3c6340e87e50722d62aa8044ec0897eeeef66d8f445

SHA512
959670b618aaeb54e357b1329af46cc557722e9828ebb9c5b9131bd41dbd0556e058367dbcd8f0866ddb12bf23b9d2b5295a5187158a5da9a653ae2513c6a744

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
3045e08e3bf83092ee6657379a6ece02

SHA1
f5d7f34b2371d866ca40f3b10f227b6f294f7dfe

SHA256
c9f6a075654cc37448181453e2f470e45f71b3b6f84069019505f1ba7d41bc5c

SHA512
e0927c3e8dfff2e1834ab9d46e2f800e4add73bc25beca2aaa388e2f53bdcf3c16d5806310523fb229e6408ec3af4a83d1c4ba9dafcffbe78fb968f572fbef64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\4f0a35aa-ee7a-4b0b-b05c-df82f4209a12

Filesize
771B

MD5
96c8c8f5327d1ccd5a401fd2cb0931ed

SHA1
02c1e8e711e01b385cb39bb6da72b22944899697

SHA256
7638a84517fea9d03279c6b618f32c4d599f782c7861e348b815ddeea2ff6eb9

SHA512
16464b3ae300432383e38518a2447f4b9d5aab8a6f65063c5959903ce0079f41cc4aab138d383d6d4804311c898a8c3ee98151281f43594e77ae9d7dac55db91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\57e2a5e9-1334-41c2-8c5c-c0a844142d41

Filesize
855B

MD5
852378be8e2ba84e719ce42df46aa739

SHA1
9c3f81a6139cb73118e09a3464be24498bec347b

SHA256
47c5b21078dba54113340c1c8e5b5492bb847a2f1fa37e612bc301a97a0ef50a

SHA512
254c64919c95ee1c98787155d19126afe47dcbbdcc6f4b5c983fc773e48c42955233c0308e09eeb4100ddd8d91a8a4741e662fa4ba92d48ece2438b719d2aea0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\9ad59c75-c1a8-4d32-b277-a127d52327ab

Filesize
746B

MD5
a426a87583b5cb570ad48ace4fb74ac1

SHA1
f0f363098920343001dada17eb7b444ca8dce030

SHA256
35e103f23ee72fa4efdb48262f8dfa35246e69705ccb71fc10f7484c9082999a

SHA512
6dcd80f34ca4da64a176ea1f3a98c6ed7af2f2be8796ada73299c668fceaa96129ccc562160dc4fec4df9aee01ed31c95e51f3ec1b6881220a35ec338e8eea71

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\ec54ef25-a88b-4e97-baa7-9b0a753c3432

Filesize
11KB

MD5
a23502701be1f82b4376787fc860ce1c

SHA1
d3c6300b699c09821fdec4ddff38de86986f250b

SHA256
853334ea744dcf7cbe48a5a35ef9f7201f0fc85b85092079b61a3c2d4bb90ca2

SHA512
7bb35abe8af28048537755311dcdf02974b995fa6e8598b279bdff38f72e87fd5a20ce50d1e21d093e066e7fbf9904e22cc26aa5aea7b7aa19d93868b00b9e0a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

Filesize
6KB

MD5
5ccc81cb4ba490d5c158ff57fc751706

SHA1
9fc80a88b16b60adc29e15cfb7704308aa14ae21

SHA256
1a54e1854960632e085463be75b4c2755ccf7c3a69ddbd0d5b9572d2fc0e6afa

SHA512
a783f62d4a1c314f9472870c0eb8628da538cc630e101b77038b0b1dec9cb406bf4fc88ddaffe11dad0e373f4a18ba196f88ccdc4a56006c699a3bc3c5707bfc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\prefs-1.js

Filesize
6KB

MD5
e97758634a0ec9d0f793bfec09bad955

SHA1
194014aa5ffe15741fdbee10f373d4b5e7a46afe

SHA256
af75db789be743c6b6382acad6793e786b3aed235dec0f5aa83a1d11382a8336

SHA512
f11508d55308e05214fd2e1ae4bb6b8955b9ac88833f14436ed26a83cc8db1a8728e1edd6c10bfefeada96bac49b4c83549df4947071184ceebbb9f610d5d465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
3d2b175e639630082103f5cf2d3a2109

SHA1
bc8ead390870fa35c3e159f79e23fb73f5c36688

SHA256
250b8a534533218907e1fb4ab7976df5afd4741f29eaa7d2c5507a9032f17afd

SHA512
73819c6cf324b402f8659fcd7341d4ffe3866715494740565d262755fdb93746a70559d9f3952663587a9330b42f2260b4e3af0ec656fd7a5cd0c0eb332b4223

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c0cdab8463887ad2e8c8a8706ff6c673

SHA1
aeec09b3b1f9eb1665a5a96bbcd944eb55513063

SHA256
7b067f883591baaa5f538a3abe2b10814c5bf5b4e0520d8476071bdbe9da0dff

SHA512
960767004f974c8100d001450137fa823ee556aa28f3fee48ed76157700551b30376cd6b2afbdd7fdde7edb09d610e4f7ed4087b43097ef7decd1cb2430d02c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
3b0c6334c45c48a257b10f75c6069c9c

SHA1
bacc2babf5dac47a7cd617ef75177ecfeb598920

SHA256
57a268a362a73501a8fd0207d6f97161096dbdfc0118dab6ab131c06ce8501f8

SHA512
84a6386daf86ea26a701eb6d53f71e0a5dea6db8bd13405a9ee949b37c7bdb8fa34f908cb9d96ac3a4024d6354c55c117559dc502ccb8272d10fd7f0cc25092e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ae3288090278e75b5c0d6296c0b9fd8f

SHA1
dc71072ed7815bec15d63b9c351b7034abfc10ae

SHA256
416b926a287552698d002c45b31668186e151c4dd322aafc6507e5978e01f391

SHA512
15646046230b0d07d0654a06d5841d3428c43ed291238ee44b2908043398ef869873cb9b10c3abade8f470d29cd8f06494f5c06acd837f92461573e79b301a69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
5843c2e36a60d2d8d09185f88d57ae90

SHA1
2200c15fcba2a65c9667f66795894d4f5fd10d07

SHA256
59ff652949766eedc6d6af53eb294246bc2cbae407978039ab63fa702c2620e5

SHA512
c7758ea40e932d254ce23aaaaa4448a18c09ed20db83e604a20b5b6ca0b524c3e1772bf89a4b031314e135d8ad40b81068e6fca0e93e8cc3a2520e8dc7499254

Download Submit