bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Analysis

max time kernel
419s
max time network
315s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42 (1).zip
Size

41KB
MD5

1df9a18b18332f153918030b7b516615
SHA1

6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA256

bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
SHA512

6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP

768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
124	raw.githubusercontent.com
125	raw.githubusercontent.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-513485977-2495024337-1260977654-1000\{A163F39D-5E8B-480F-A5BE-3A8E32093FEF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
1900	msedge.exe
1900	msedge.exe
4752	msedge.exe
4752	msedge.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
5284	identity_helper.exe
5284	identity_helper.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
5736	msedge.exe
5736	msedge.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4732	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	taskmgr.exe
Token: SeSystemProfilePrivilege	4732	taskmgr.exe
Token: SeCreateGlobalPrivilege	4732	taskmgr.exe
Token: SeRestorePrivilege	5720	7zG.exe
Token: 35	5720	7zG.exe
Token: SeSecurityPrivilege	5720	7zG.exe
Token: SeSecurityPrivilege	5720	7zG.exe
Token: SeRestorePrivilege	1484	7zG.exe
Token: 35	1484	7zG.exe
Token: SeSecurityPrivilege	1484	7zG.exe
Token: SeSecurityPrivilege	1484	7zG.exe
Token: SeBackupPrivilege	4952	svchost.exe
Token: SeRestorePrivilege	4952	svchost.exe
Token: SeSecurityPrivilege	4952	svchost.exe
Token: SeTakeOwnershipPrivilege	4952	svchost.exe
Token: 35	4952	svchost.exe
Token: SeRestorePrivilege	4676	7zG.exe
Token: 35	4676	7zG.exe
Token: SeSecurityPrivilege	4676	7zG.exe
Token: SeSecurityPrivilege	4676	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4732	taskmgr.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 1848	4752	msedge.exe	114
PID 4752 wrote to memory of 1848	4752	msedge.exe	114
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 2876	4752	msedge.exe	115
PID 4752 wrote to memory of 1900	4752	msedge.exe	116
PID 4752 wrote to memory of 1900	4752	msedge.exe	116
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117
PID 4752 wrote to memory of 3864	4752	msedge.exe	117

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\42 (1).zip"
1⤵
PID:2692

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x9c,0x128,0x7ffa62ca46f8,0x7ffa62ca4708,0x7ffa62ca4718
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3816 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,12575979099171992117,9065867651074944582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\42\" -ad -an -ai#7zMap11939:66:7zEvent25841
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\42\" -ad -an -ai#7zMap19288:66:7zEvent6342
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3112:66:7zEvent18875
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\098fc972-0c34-4f18-909c-690088e8134a.tmp

Filesize
11KB

MD5
83bb9916b4f48895e23d3667be0d6ded

SHA1
64836ac5047985d3488d02cc348e0cad6d844b0f

SHA256
e9fd354a4aac039d47e01a1c252d88c3481f630b92dbc4f89725dab3c22ded17

SHA512
6f23b76d64dc6f57b96033cb0280e2efcb7c39b8a2fae0ebee2ef9fe2046623d81e24c57ffd368cfa3ff0e390a042d43da98a8157ecaa4a03d738128b91045f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\022854a2-39c2-44e1-8f01-db2907de80bf.tmp

Filesize
6KB

MD5
14ec389ce1dede1d1a7a6916d8269bad

SHA1
2170a2a1a469e4f20c1deecedf1bb9442182456a

SHA256
de058ca12d8d69ff29ebe5665ff3142009987fbfd07eee736051c6922c7df5e9

SHA512
4e82d1066a0459d3d0fbfa5ed4208716191612b49c0a2b5be111ab7b4091867017f1cf358b083d320230d55ae1fb74b07ea83f3970e434190de276b54ad4c612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
520ef907ba7383823d6210a64b0dbdc2

SHA1
b824a8b9f81e8a52d719ee0aa7029d28d21ada9a

SHA256
c714d23b94f1d62117c94a3d7ae9942247016762415b867d40a18026f5912f05

SHA512
7167f3949ee18365d79cd44687961537101836202bf6a24a67adf66edaad7e8713dd4ce52539d82cd7f378e0fd537decfe821716354e84e5a32a860b253ac84a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1019B

MD5
19c4f262b15010aa2843272717a711e7

SHA1
69e1e914ab7a19b6ce524b81e80d4e15a79f8d6a

SHA256
abe9a4b3384edb02922bfed0990432bf60cafe6061e17a6e36dbc9bea89259a4

SHA512
73b22ce93c9a372ea5c9dec0d6bd5a3078a2b523681120259c5982f08c95fa51ba10156be851be901af430aab4ccc4141d8a43f547602d67f7a2ff4c76b0713f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8cb830d77b807cea118227084e4d3d93

SHA1
2ffaeb316071f71f12e05d02d20dbc4d9d653150

SHA256
4ed7c35636dd05a035efa4e3ca9e7ff9836c8308e680c6dd49e9953aa6e7079e

SHA512
322d89e3bb0000b8e82bf4d9f27dec28df5646047bafee269f1003acb506cad1ee4e6d64b668f0230da48e0c341c6985850dadb58a1fcb1428d0acbaf2560b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14574532edca07b03f4ae2c6210820a3

SHA1
f9ae394904e53f20a405ce00fd283ee5261ce1a5

SHA256
b7816372f2010a93d3a35e1f45c5d117971f2cb8fae1c6363f0416921798142b

SHA512
d149602fe25d5d22cfc45899de28fe403444de7977739aa8346a06e679a28acc306a37613e6a723ee6f9c16fc4d8ba29b96d43da709ada01b6edfed831b7238a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5502eef3bc385934b622eb5aadd4bb69

SHA1
d87fe1e5d73bb26d95c5bfe2c870ec441cc658a1

SHA256
8e0c6886beee9702749060bab824184b15226a8bb909ec72ec6884f8c3434c5a

SHA512
91c16476b74112449e88f685df0f5e5dde351f746c04d8323e1dbb5e4c24931713a2de0a58b069164990bf88905a5e69c53c7a3ab9fc8c51a30884927c6e5f18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
914eb8eb2806784fd5098ebe8b061705

SHA1
eb26c3477bc1ae86138e520352cfe93e0c694b9b

SHA256
d7482ef69641eec4b466d0d6161f6988bc1bee8cf3ce8532b0c6c1762a73a2c9

SHA512
22aa00123e1e73c3345eddd407c7b64e5219a7e83068b44158c7ec95849de1874cce903abfcc832ae3e0b46d447943c3db9dc1268f4fa0d9df7b8aed7dd6755f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58944c.TMP

Filesize
1KB

MD5
c294f0a4dec328713af92796fdce0c5a

SHA1
81cab91f7542da41bfa65f83041ceb0d71e3a2b3

SHA256
199ef7aab7996c296f630f41a03833bd823323a1b049c17fd4792330d8022e7d

SHA512
fd771bae18ad08b043db8efe131ab160e240786a6be48eb5802dd81b36640ba20addea7d3075f855d9663b0046801430d2879ac20706a367d88b8da58e7d9707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd54e9d5e1b81445122113dab033fe00

SHA1
77aaccfc183c404ef825eeec5d73cfdb691f141c

SHA256
1796c1d86347a0477e24aa7090400a27af03b3e619c7a45e153b0f784625f607

SHA512
4b895dd924870e552afa7a2f488dfff4d638164b22d1ed0d20b49c406a59bfd0e386e8a1832a21c3c9fe621443d2527bf713b47f252aa0007eec0b4e989bc0dc

Download Submit
C:\Users\Admin\Downloads\42.zip

Filesize
41KB

MD5
1df9a18b18332f153918030b7b516615

SHA1
6c42c62696616b72bbfc88a4be4ead57aa7bc503

SHA256
bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

SHA512
6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80

Download Submit
C:\Users\Admin\Downloads\42\lib 1.zip

Filesize
34KB

MD5
0a76bd3e26768bba68aca3d210997069

SHA1
753690994a18cf58ed0fe3749d16448b763047b8

SHA256
9056b87f079861d1b0f041317d6415927d9ffb6498ce2530ff90fda69fa64e78

SHA512
14408ea7f44bc365a58d7480fff9ea3b10fa21bfbd3363c6e30b74a4d4121677e20ce1108cce12c203f0760768aee1c1aa69b130e090c409f9a516ea02d70c49

Download Submit
memory/4732-11-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-12-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-0-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-10-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-9-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-8-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-7-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-6-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-2-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download
memory/4732-1-0x000001CC4A0B0000-0x000001CC4A0B1000-memory.dmp

Filesize
4KB

Download