Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/03/2024, 08:13
240312-j4mxxaec84 312/03/2024, 08:10
240312-j2q7jscd2y 612/03/2024, 08:09
240312-j2cn6acc9y 1Analysis
-
max time kernel
144s -
max time network
161s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/03/2024, 08:10
Static task
static1
Behavioral task
behavioral1
Sample
Bandit_R6S.png
Resource
win11-20240221-en
General
-
Target
Bandit_R6S.png
-
Size
194KB
-
MD5
3e8f2ad9cfabe7114ba0653233590690
-
SHA1
ef502bd77f17b24bdfb86b6a692a07e7783ac431
-
SHA256
d9313d8b5df341b4c1178fba770a7fd56819aeca7d56ee01f86d7861635f108f
-
SHA512
c863b3bd80bbe93227e34963eef484708308b3ca205ff32ca83140cb0e0f311bdf7bb64b5dcae3e29d6e73ad1c535fc20fdb3ed4281c9bd35c60fdc443833fd4
-
SSDEEP
3072:VDDYNAMbdd9NH0rbfMI9qdvszHpLQ1/7L2HUKiNv2h520oHRSeGkoaKIV7alpM53:iNpX9NHK0I7zQ/NNvS52UeDFO+IjI
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 17 discord.com 67 discord.com 68 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1101742937-4171729779-750941522-1000\{86D58BD4-E46F-45EE-8EBB-A90C3FB6427A} msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2232 msedge.exe 2232 msedge.exe 2368 msedge.exe 2368 msedge.exe 5352 msedge.exe 5352 msedge.exe 5716 identity_helper.exe 5716 identity_helper.exe 5256 msedge.exe 5256 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe Token: SeDebugPrivilege 2364 firefox.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2364 firefox.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2364 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 1676 wrote to memory of 2364 1676 firefox.exe 85 PID 2364 wrote to memory of 4332 2364 firefox.exe 86 PID 2364 wrote to memory of 4332 2364 firefox.exe 86 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 1500 2364 firefox.exe 87 PID 2364 wrote to memory of 2116 2364 firefox.exe 88 PID 2364 wrote to memory of 2116 2364 firefox.exe 88 PID 2364 wrote to memory of 2116 2364 firefox.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Bandit_R6S.png1⤵PID:3700
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.0.335868923\559834913" -parentBuildID 20221007134813 -prefsHandle 1796 -prefMapHandle 1788 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3b8ef28-565a-4128-bb0b-99ef8e55ba13} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 1888 181c09f9258 gpu3⤵PID:4332
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.1.366886228\1688917591" -parentBuildID 20221007134813 -prefsHandle 2252 -prefMapHandle 2248 -prefsLen 20783 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b615bde6-5a00-42eb-9ab4-c09c7a757832} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2264 181c0906e58 socket3⤵PID:1500
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.2.1351270541\2059634714" -childID 1 -isForBrowser -prefsHandle 2864 -prefMapHandle 2880 -prefsLen 20821 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa749015-00e1-4b93-99de-15a16400d092} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2856 181c4deb558 tab3⤵PID:2116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.3.1844224721\1722354677" -childID 2 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e77669b5-9151-4f01-922c-750c1452d32a} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3348 181c5898058 tab3⤵PID:5048
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.4.575876738\1289377583" -childID 3 -isForBrowser -prefsHandle 3484 -prefMapHandle 3488 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e638b5c-cfe6-4126-8d41-c9060d493ff5} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3472 181c5898658 tab3⤵PID:2716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.5.712099932\764151526" -childID 4 -isForBrowser -prefsHandle 3768 -prefMapHandle 3764 -prefsLen 20927 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3be2381-e0bc-442e-b7a4-b79ddffa7f9f} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3684 181c5896b58 tab3⤵PID:5112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.6.7678912\2086120793" -childID 5 -isForBrowser -prefsHandle 4160 -prefMapHandle 4156 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8822386-d392-4bcf-80f5-92a62bb9b0e2} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 4172 181b4962b58 tab3⤵PID:5104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.7.265969256\1622464648" -childID 6 -isForBrowser -prefsHandle 5252 -prefMapHandle 5340 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1d0eba6-7970-4045-8c98-ac6f81a45b67} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 4544 181c7be6058 tab3⤵PID:2164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.8.413706878\177988766" -childID 7 -isForBrowser -prefsHandle 5376 -prefMapHandle 5484 -prefsLen 26283 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78cb336f-f30d-4be7-ac82-cf1a7899a4a1} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 2860 181c2203858 tab3⤵PID:2584
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2364.9.897162130\1468023906" -childID 8 -isForBrowser -prefsHandle 3620 -prefMapHandle 3632 -prefsLen 26723 -prefMapSize 233444 -jsInitHandle 1232 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6ea05d22-6eb4-4a2f-8088-38786a0117ed} 2364 "\\.\pipe\gecko-crash-server-pipe.2364" 3596 181c7be6358 tab3⤵PID:1116
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff881153cb8,0x7ff881153cc8,0x7ff881153cd82⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:22⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:82⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:12⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:12⤵PID:5140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:5772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:5780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:5964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:6052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:12⤵PID:6060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:12⤵PID:5484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4944 /prefetch:82⤵PID:5268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4032 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:6000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:6016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,14134158556939402575,16513986363642417551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:5884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3672
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5601fbcb77ed9464402ad83ed36803fd1
SHA19a34f45553356ec48b03c4d2b2aa089b44c6532d
SHA25609d069799186ae736e216ab7e4ecdd980c6b202121b47636f2d0dd0dd4cc9e15
SHA512c1cb610c25effb19b1c69ddca07f470e785fd329ad4adda90fbccaec180f1cf0be796e5628a30d0af256f5c3dc81d2331603cf8269f038c33b20dbf788406220
-
Filesize
152B
MD5a91469041c09ba8e6c92487f02ca8040
SHA17207eded6577ec8dc3962cd5c3b093d194317ea1
SHA2560fef2b2f8cd3ef7aca4d2480c0a65ed4c2456f7033267aa41df7124061c7d28f
SHA512b620a381ff679ef45ae7ff8899c59b9e5f1c1a4bdcab1af54af2ea410025ed6bdab9272cc342ac3cb18913bc6f7f8156c95e0e0615219d1981a68922ce34230f
-
Filesize
6KB
MD568713c370971ec3d8629ab2b90382cf9
SHA1a622cd34e486a3dd6f8db835a078d68b71f97184
SHA256291808bf2a18fad69af307421c692d3a77d4b2ef5f9ad28edf54b77e67347be8
SHA512b36dcc35dad8120c29e13d31a091c90ff77d2f1ad1e2bfc9d14fc2eed7cb3e295694bda6f5c7392696101c7c4bef78c99319b10e4510859040908b159f2224c0
-
Filesize
5KB
MD529a096744c201583f2c832fe159e9dd9
SHA1b3e7d3147137642b5ae4e97a78f6799d63d9f64c
SHA256886f44ecdb82c5835b891e4ddc09feaa891e9bd9957c9dcb53da547810318548
SHA51228358fe926d709314d58a185afa3dd3eafd52084cafca7874f51e1079c9054b2cc15a1bc9552913034dc0ee063f84cfe8c07a6e46b8dd5816a54801927df31cb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD54ef08fce86f0b470d97f3c87624f7396
SHA19dbdd39731d2554fbc245bdda78fb741bab0df55
SHA256949460fa4425fa3f00433bb6f5588cbefd17849cf97e180f5db14c43160062fc
SHA5127c872126118dbf6995de063861a79e7d5d5a15c2e35028638819fc5e398eee483f29025c59bdaaf281eeda5ea5e9b2fb33a5ab1d46a2d39a4de051ee1853496c
-
Filesize
9KB
MD53f1fc0b11b9f879f2b187eb525ba12ed
SHA15b94f609b6a58cdc8aa049dfe739868e2ce36c87
SHA2565aec29baa7af2100ea8bb12298b98592e1a42fcd42560f44b3219191f129f517
SHA5126c92f4c45a7e676b68b3c68419e932cb87496bd31c03f73d4a9d34dd9fe768804099194e426699d34a40b4bf637c57c8cd974d5fe912c06bac94ee6614e6e805
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\45514F58EE166DE19E4DE720A21DDF1DA12F6C6C
Filesize203KB
MD55efed4b837d68d06a320c95314ad65b5
SHA1f71a96dca2c77ec91a44c9c531fdb187184466a5
SHA256703bba1257e1e71f743d29f7be23eebd9c76057646f904e0a5ba3404d0343085
SHA5120586cef9d659850fdbd70299fad67e89ce997c237bf52916bb37888644756a66dc1d83b99ff85e4505f7e34f9723a201dabc03e94e344e342c626c6d8a8007d7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\cache2\entries\4E0C28FF25B34AA6D81276C14EFAA147A7403E02
Filesize22KB
MD5507d4b83a7e907897b38da8f2a213a00
SHA1232535a48bae919285a3a174f7cee87bca7027e5
SHA256982a7786474226c5e6a0d3c6340e87e50722d62aa8044ec0897eeeef66d8f445
SHA512959670b618aaeb54e357b1329af46cc557722e9828ebb9c5b9131bd41dbd0556e058367dbcd8f0866ddb12bf23b9d2b5295a5187158a5da9a653ae2513c6a744
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD53045e08e3bf83092ee6657379a6ece02
SHA1f5d7f34b2371d866ca40f3b10f227b6f294f7dfe
SHA256c9f6a075654cc37448181453e2f470e45f71b3b6f84069019505f1ba7d41bc5c
SHA512e0927c3e8dfff2e1834ab9d46e2f800e4add73bc25beca2aaa388e2f53bdcf3c16d5806310523fb229e6408ec3af4a83d1c4ba9dafcffbe78fb968f572fbef64
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\4f0a35aa-ee7a-4b0b-b05c-df82f4209a12
Filesize771B
MD596c8c8f5327d1ccd5a401fd2cb0931ed
SHA102c1e8e711e01b385cb39bb6da72b22944899697
SHA2567638a84517fea9d03279c6b618f32c4d599f782c7861e348b815ddeea2ff6eb9
SHA51216464b3ae300432383e38518a2447f4b9d5aab8a6f65063c5959903ce0079f41cc4aab138d383d6d4804311c898a8c3ee98151281f43594e77ae9d7dac55db91
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\57e2a5e9-1334-41c2-8c5c-c0a844142d41
Filesize855B
MD5852378be8e2ba84e719ce42df46aa739
SHA19c3f81a6139cb73118e09a3464be24498bec347b
SHA25647c5b21078dba54113340c1c8e5b5492bb847a2f1fa37e612bc301a97a0ef50a
SHA512254c64919c95ee1c98787155d19126afe47dcbbdcc6f4b5c983fc773e48c42955233c0308e09eeb4100ddd8d91a8a4741e662fa4ba92d48ece2438b719d2aea0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\9ad59c75-c1a8-4d32-b277-a127d52327ab
Filesize746B
MD5a426a87583b5cb570ad48ace4fb74ac1
SHA1f0f363098920343001dada17eb7b444ca8dce030
SHA25635e103f23ee72fa4efdb48262f8dfa35246e69705ccb71fc10f7484c9082999a
SHA5126dcd80f34ca4da64a176ea1f3a98c6ed7af2f2be8796ada73299c668fceaa96129ccc562160dc4fec4df9aee01ed31c95e51f3ec1b6881220a35ec338e8eea71
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\datareporting\glean\pending_pings\ec54ef25-a88b-4e97-baa7-9b0a753c3432
Filesize11KB
MD5a23502701be1f82b4376787fc860ce1c
SHA1d3c6300b699c09821fdec4ddff38de86986f250b
SHA256853334ea744dcf7cbe48a5a35ef9f7201f0fc85b85092079b61a3c2d4bb90ca2
SHA5127bb35abe8af28048537755311dcdf02974b995fa6e8598b279bdff38f72e87fd5a20ce50d1e21d093e066e7fbf9904e22cc26aa5aea7b7aa19d93868b00b9e0a
-
Filesize
6KB
MD55ccc81cb4ba490d5c158ff57fc751706
SHA19fc80a88b16b60adc29e15cfb7704308aa14ae21
SHA2561a54e1854960632e085463be75b4c2755ccf7c3a69ddbd0d5b9572d2fc0e6afa
SHA512a783f62d4a1c314f9472870c0eb8628da538cc630e101b77038b0b1dec9cb406bf4fc88ddaffe11dad0e373f4a18ba196f88ccdc4a56006c699a3bc3c5707bfc
-
Filesize
6KB
MD5e97758634a0ec9d0f793bfec09bad955
SHA1194014aa5ffe15741fdbee10f373d4b5e7a46afe
SHA256af75db789be743c6b6382acad6793e786b3aed235dec0f5aa83a1d11382a8336
SHA512f11508d55308e05214fd2e1ae4bb6b8955b9ac88833f14436ed26a83cc8db1a8728e1edd6c10bfefeada96bac49b4c83549df4947071184ceebbb9f610d5d465
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD53d2b175e639630082103f5cf2d3a2109
SHA1bc8ead390870fa35c3e159f79e23fb73f5c36688
SHA256250b8a534533218907e1fb4ab7976df5afd4741f29eaa7d2c5507a9032f17afd
SHA51273819c6cf324b402f8659fcd7341d4ffe3866715494740565d262755fdb93746a70559d9f3952663587a9330b42f2260b4e3af0ec656fd7a5cd0c0eb332b4223
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5c0cdab8463887ad2e8c8a8706ff6c673
SHA1aeec09b3b1f9eb1665a5a96bbcd944eb55513063
SHA2567b067f883591baaa5f538a3abe2b10814c5bf5b4e0520d8476071bdbe9da0dff
SHA512960767004f974c8100d001450137fa823ee556aa28f3fee48ed76157700551b30376cd6b2afbdd7fdde7edb09d610e4f7ed4087b43097ef7decd1cb2430d02c0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD53b0c6334c45c48a257b10f75c6069c9c
SHA1bacc2babf5dac47a7cd617ef75177ecfeb598920
SHA25657a268a362a73501a8fd0207d6f97161096dbdfc0118dab6ab131c06ce8501f8
SHA51284a6386daf86ea26a701eb6d53f71e0a5dea6db8bd13405a9ee949b37c7bdb8fa34f908cb9d96ac3a4024d6354c55c117559dc502ccb8272d10fd7f0cc25092e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5ae3288090278e75b5c0d6296c0b9fd8f
SHA1dc71072ed7815bec15d63b9c351b7034abfc10ae
SHA256416b926a287552698d002c45b31668186e151c4dd322aafc6507e5978e01f391
SHA51215646046230b0d07d0654a06d5841d3428c43ed291238ee44b2908043398ef869873cb9b10c3abade8f470d29cd8f06494f5c06acd837f92461573e79b301a69
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f6y7ha3v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD55843c2e36a60d2d8d09185f88d57ae90
SHA12200c15fcba2a65c9667f66795894d4f5fd10d07
SHA25659ff652949766eedc6d6af53eb294246bc2cbae407978039ab63fa702c2620e5
SHA512c7758ea40e932d254ce23aaaaa4448a18c09ed20db83e604a20b5b6ca0b524c3e1772bf89a4b031314e135d8ad40b81068e6fca0e93e8cc3a2520e8dc7499254