cdd18d63300d3a65397944c1520d4292be3dcc402aab2e60abc5ca3a46015d11

Analysis

max time kernel
157s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
Size 894KB
Sample240330-blws4aed99
SHA256 59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308
MD5 2f8912af892c160c1c24c9f38a60c1ab
SHA1 d2deae508e262444a8f15c29ebcc7ebbe08a3fdb
SHA512 0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb
SSDEEP 12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TN:qqDEvCTbMWu7rQYlBQcBiT6rprG8aAN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
4168	msedge.exe
4168	msedge.exe
4600	msedge.exe
4600	msedge.exe
1140	msedge.exe
1140	msedge.exe
5328	identity_helper.exe
5328	identity_helper.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4600	3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe	88
PID 3528 wrote to memory of 4600	3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe	88
PID 3528 wrote to memory of 3920	3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe	90
PID 3528 wrote to memory of 3920	3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe	90
PID 3528 wrote to memory of 2852	3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe	91
PID 3528 wrote to memory of 2852	3528	59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe	91
PID 3920 wrote to memory of 4236	3920	msedge.exe	93
PID 3920 wrote to memory of 4236	3920	msedge.exe	93
PID 4600 wrote to memory of 1056	4600	msedge.exe	92
PID 4600 wrote to memory of 1056	4600	msedge.exe	92
PID 2852 wrote to memory of 1040	2852	msedge.exe	94
PID 2852 wrote to memory of 1040	2852	msedge.exe	94
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 4300	4600	msedge.exe	95
PID 4600 wrote to memory of 1696	4600	msedge.exe	96
PID 4600 wrote to memory of 1696	4600	msedge.exe	96
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97
PID 4600 wrote to memory of 4668	4600	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe
"C:\Users\Admin\AppData\Local\Temp\59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c1fa46f8,0x7ff9c1fa4708,0x7ff9c1fa4718
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:100
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
    3⤵
    PID:4140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7311384024423151205,1541631058328282064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6576 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9c1fa46f8,0x7ff9c1fa4708,0x7ff9c1fa4718
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9838708761884351647,16725016558069960117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9c1fa46f8,0x7ff9c1fa4708,0x7ff9c1fa4718
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3578220534826520856,3153563117297699310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3578220534826520856,3153563117297699310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
MD5 36bb45cb1262fcfcab1e3e7960784eaa
SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 41a9494610799963719b28a9755ee2bfda34cf4ba54cb483d11e9b74630dcdd1
MD5 c51effb6fd991becc86a08e3981d8509
SHA1 6909fef72a5d49b631fc2efcf7d5aba7dd7e2fb0
SHA512 f3e95dde74877f0d68e788cc027a95b31a1323d88c6ecde5ae9fa252d7e1960d22da368978413c6803eff2b2af7f9d126fbc851c4d6710ca642e4e6059d3c04e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a1c464dd79cf4b48fe3c7c6a1de3e7e364e06c239a2559ecc79869f1a9ecc200
MD5 0aff8ef212eb45dd1f101e187d667657
SHA1 cd6a48321fb826927f62073ebf38127ead7caa8c
SHA512 4f3ff14393cce6c968bec7e16ed5c5f67042b1c43e60da877a3d22cd4e1016856181478c9cb2fb28806d66fea727c3d9b7500bc0f4541093880bb12fffec66be
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b7325a99ede05704f9514e0b3ef6bc1c3ec20ba329fa9cdb65a5202b190fd270
MD5 e3a6b7f5995345d7540f9f89e70cdc0c
SHA1 f05597a72c4bb177ba4c3a9d2f0a12114dcfdd51
SHA512 745befe6a6fb497a23c1a21bf63180b909bc20898580d493b923b85425f12367700effebf3ceaeaa48b17a24b2270fbf43a5f5feb87a0c2997429a5b1acb184b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 36e5997c0606b592a2a077e48c9bf9766a3cdb2c97a0308343d708e4838469df
MD5 f19dc4dc91433641e64c90f2a3444e4b
SHA1 5f8b3f49ee146136b184381e7d5100153b7c1a9a
SHA512 fa019128a633338799a2cfb2586d7ad9fc72b74e00c5b60ed9c7cfd624c818ad2d2ec8347b6b21fcfd9f0c907fe35ff82cf32f9a0cf0e22ada3db0a448f6c19b
SSDEEP 192:nbkli7KNsV8kfvnWMDuhsku//5uVsxnrg:nb72NslWx+2V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 072c3bf6c4c6da03523034a7bb9af7506e660f90378365932461d87f4d731abc
MD5 ebd6eb8c46e93b61f600f7fa29a93ae9
SHA1 b50dbf58964d41379060b322be90f2a2b20d0ca8
SHA512 b5914b410a6ba44bec37b7c829655adb93891f78bd8f453697c6ec8423b67dd1bd635b9155681e0fbd9bce28b78c5a3e2b2ddf0f28253b8a6ccaa8e9af4f57ad
SSDEEP 96:nbkPBi19aNsV8wpvWMoiVmdeHCu7RUWQyV+VD7ziEwb:nbkJi7aNsV8GWMX/rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 08fe7e92cf32a98a9b23a6ed455c7958d03a0db8d7b676fd9edcb037debdef9e
MD5 52ea4ec950516f14f98fa8c9a9e0ad4d
SHA1 c9192155f71e06152da00979fd93343ff8ba8726
SHA512 ba43af3198fed761749c72aef1529fd5670f2dcecb6164f3cadc00def572228bb7e7f9d65a8106dd8ec7f2547c71d9bbf9fa663c6f8337e04ceed32244e10113
SSDEEP 192:nbkki7KNsV8kfvnWMDuhsku//5uVsxlrg:nb02NslWx+2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 ba935f10889ce23538e530194a63de3e4e8f360de1664b891081ca09581754f3
MD5 a5fd20c949a2b1ea9c6b651ab03c8ff0
SHA1 1034918a4dd819821bdb4629bbd91016fed12201
SHA512 99b831b9993eb23f13b1f67a6ef155b2080ffd3c803b1bdc3b131bb2b216b9d7870a52107ebaeb9975536c95f8898f724e692d575b0c61252c484129d6f6067f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 2eb459c4f4733458b3cbef97274192f97fed30543cbc745536284b66e32902b6
MD5 ac67e7bd3c5266e2e9a33d29ed08668a
SHA1 8bd4150a316973bc98732b473666024f66fed598
SHA512 02f66e5aae3a1045545fc5e1c49e84c19345d3ab5fb4d6131dbfae3d5b406c6f15c6ec7417e80ac04021d52685387228bf964fc78599c0a3c05c5308ef71371c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 bb4f00b3ef247604d2287dcfdf5d25cc32f615e60d993fb4c76370cc52cd8db8
MD5 1ac6e26a7fe1e3dc654281674f04a4ba
SHA1 eacac59f677e389a7e4c1630cd97dc6e2759c4ee
SHA512 12c284783c1f2110d7ffa83a7eb86dd9f6588026d1ae43fb1ea2953e34de67610ff6fed9eb763fa5b21bb514afc1a22f521c37854b1e5d682bae525270eaaf6f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ea9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ea9e.TMP
Size 707B
SHA256 4d611f672e2e4b88b5c6d899b7919f3134120c09df1f8bd03b246328a2cc859d
MD5 ae4e62e324e55bb26bf3f21ad11e3ae7
SHA1 1734516c074745968ad3da6164d3e53f20a2f0cd
SHA512 c9ff9b8e30f3f6f4fb21fc257a7c9fd5c0de3e64b6e0d316db616f007f528e3295f305517849d8cc33528258e13e031f3739b92a9e630979fbfa2c747bba3d4b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9282e58a36b70972654d053d9f008a41022adf63cd726e82ec3102e03354b2e2
MD5 564c70a49d8e81ac0d3b914f82142f99
SHA1 59a5f340b2da6192a6f15490638359c2db451224
SHA512 197fe914546d75eca689296772a33b566b4b88a02524187b952e331c152a4a0c9d8a9513e64e480662139e4accd78a10aa8983735f0336c28222b0167ec1a0e1
SSDEEP 192:joCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwe2RUG/NvbqZfcJ:D9iIxuERzA83h09RZxYubV+q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 677a8dd336ef2187545ad3659b1603ead09382d69e67b59f3954e779b0083d95
MD5 9d3d1092e6666dc92c3415ec9956b851
SHA1 039b631aae33770f24a7dffe2b8501033f238652
SHA512 d9581014ab49ef53e4cb7a1ed172683f782a1f445d79ec6f238539bbfcc6e83083c1eb194c226fb328a01b19c0140049c4414e5ba2d86dbdb3b49da5d8d73b4b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMDe2RU1tzvbq6znIYWLSDN:A9iIxuERzA83h09RZxYMTGJ+6zIDG8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2de1ccf979f262b636e0dad5680578c7d84ed9506b7e4b88589c7d0f98e76f8
MD5 12960db3a2db0bc4ccaa7116da7baace
SHA1 0f5195769d7da578d5ed35520596766598d63e54
SHA512 98df62a93e7dfec5bb82d78a51b0b6fb4891983d955347587445fbe7d2283f9c9f2bc59be16ebae4f01bbfbbcc40a27bf96e3fa6ed71ce0d30fbed1b754259ff
SSDEEP 192:joCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEe2RU0/NvbqJcJ:D9iIxuERzA83h09RZxYqRV+G
MD5 SHA1 SHA512 SSDEEP

Submit Download