hxxp://giris[.]eba[.]gov[.]tr

Resubmissions

04/04/2024, 16:45

240404-t9qk4acg6s 10

04/04/2024, 16:44

04/04/2024, 16:42

04/04/2024, 16:39

04/04/2024, 16:36

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
04/04/2024, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://giris.eba.gov.tr

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280069375-290121026-380765049-1000\{546EBA91-D442-43F7-B47E-4B82F78BB672}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
2572	msedge.exe
2572	msedge.exe
1660	msedge.exe
1660	msedge.exe
3892	identity_helper.exe
3892	identity_helper.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1284	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3524	osk.exe
3524	osk.exe
3524	osk.exe
3524	osk.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1864	2572	msedge.exe	77
PID 2572 wrote to memory of 1864	2572	msedge.exe	77
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 1524	2572	msedge.exe	78
PID 2572 wrote to memory of 4900	2572	msedge.exe	79
PID 2572 wrote to memory of 4900	2572	msedge.exe	79
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80
PID 2572 wrote to memory of 236	2572	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://giris.eba.gov.tr
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe15f93cb8,0x7ffe15f93cc8,0x7ffe15f93cd8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,9935104444983338352,3220235895833280431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
  2⤵
  PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1820

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2004

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:4440

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3280

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2508

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
PID:2696
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0407c5de270b9ae0ceee6cb9b61bbf1

SHA1
fb2bb8184c1b8e680bf873e5537e1260f057751e

SHA256
a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd

SHA512
65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ded21ddc295846e2b00e1fd766c807db

SHA1
497eb7c9c09cb2a247b4a3663ce808869872b410

SHA256
26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305

SHA512
ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
aa8cf3126300eb948e06c4c55e2b5e00

SHA1
04ce01edf47885ed46b24fcd41cf69c68722b33d

SHA256
f455097552bd5d3ceb7c7b960686c289f74c1c173748711258c9adefdad0985a

SHA512
9c97bd5946ff9a1806f0058b430438fc513729bbd3f62b83467a28587104efbc4689ab7fd034e971d26d53ba87fef5c6928b7db63ff1deea2c86516f594db305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d2372e0b5274d460c9572a0270926e1a

SHA1
d22cacfb8f03575e44c46cfa4db5646af3153227

SHA256
cb8e85b8fe2db23f248427e12f1bc4896155473eb3f409576afa79a3fafdde5d

SHA512
b687fe3b3356ac46a9d78a66e36057211f780db8a281116bf0cffbb4d7039f088abf2f9373fda22a0787244a2dad5ab28adcfd884a16fe88ea1b9753fb45884b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
84ec863c47e4af3a674682473ed5e8e8

SHA1
7987d3c89513af8e60405014fe3b6dd467586ed1

SHA256
fefec52fceb62b19ab221a22062eeb841c293139937bfb5b80279fa1527e7c9c

SHA512
73e82bcb26da92273da1f426ebeed803189028d2e75b5b5a7b188b0ac43846b431901e3dd8dc331519a891c738130b775b3b8ace04f9bda18717f85b28a4295b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf2723845e1f7d26dfd435a6e1ccabaa

SHA1
37b639392520efab78c72cec3c167d25462bfa35

SHA256
791b2a8a1ad6c57dd80246519dc91af6531252c0ac2cc82d8181f59e10fc98a2

SHA512
45005d37e6972603b7fc7f9f566763bff57b61abe1d1c645186f4726189ff4500684d16af07db28dff7f983de7761ebe13666ac5acb565745b16e4e64b60d429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db56a8eb5e74efec96e155197ff787ab

SHA1
3ca145ff2849816edfd1963d3d28be4d5b12329c

SHA256
859bb4ed038b1d04ece5a32ccad83100f664b7bf6c3bd0fc7a602ffe6c6cf468

SHA512
506048e78bbe4c11f0f537b708cb5b10a7dee2bf78c131042947c1983d209a97bc42361f127df991df47b20651ce5c491cd717df4a0bf3214b75c00016c20bce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
152202027f69270ffabb18609ad24b70

SHA1
332df7a03de38b68753cca589e16d6c39c2af20e

SHA256
ef48536eece0acf3fd70b793460371375bb6a7195f49049731ce6f16b068c555

SHA512
572a323280dadac1a80cc9299cf14f4a35745ce03d242f49353e0696747957ab774888e52e9fbb948068184129d2ddf3409c7eeabf9ac9fe4b87616191abdcec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ddff45073fc6dc35b2c4c447f83a9f6

SHA1
79c9827d8b18e5db30eeee727ae72db213f3e888

SHA256
f8b6bb5d3d9de279018b7187421c1be2aa80423e76f9150969aeea6915be52d0

SHA512
8629a70f760347e2691e341a0c9d0914a2b453f6aac4759485998228d78f9be1def4b126c0dcb378ee6d2b9e49ec671377d7398a47606135ae5cac8e09e453ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
74c553d99f96abb81518eab4d0076915

SHA1
5abfc36e4dfbd9954d3b3e08f3b975db50b921ad

SHA256
53c75d4070b1d8243f4e8f063d068456026dc95362f48ee270446c815327b865

SHA512
c91bea3f3ddc197072112ec81d3e4928c2439ab2543114797b73b9ab3d79b409e8e49c6188ba9a11129c7c5e3be36f5b3c2b845038e148e034027a45daf66b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5999a6.TMP

Filesize
370B

MD5
c9692a036bdfa77285826b18ba73bb37

SHA1
b748d78345d59bc506c1e7aa72283577a428e21c

SHA256
ca617372c8d7c7a6ee3142939b2dbf6a388527a5372968f24c5150d2c48e93f5

SHA512
5836d3468f1767e816e8909f05dc881a9f9b50dce37d1527e08f9311679f748fa27b2ff8c22b1f111932446c0b474d6251e7f0990a8b1481b026817c22a3f6a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
421611c1578750fd700a8ddfadec8718

SHA1
b1020a256274900cfa36c11bd7497c6bb0a5dd18

SHA256
cb25627fe2aec7006cec9927cae5769fcf9138432cfb515606c63e9747a16fc6

SHA512
b22b565fe3fd3da279ae9a2bceb6c55c00f5dc67ec56bf5bd33d01f9476c844375a371262e5fe0ca3181b564d7ed4cef82e4bad12727f062bcbd69d97ff0ce01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
831fabe5eb41b4d8ff919d2ee9a85aca

SHA1
cce915d73be0b13a20611ee0af126119d48788d6

SHA256
4e9da68b2745dbdbca69cb9f0bddac5d564af88d5089b6e19bfd60622601f878

SHA512
b6b9e0668c0da1e72bafb305f7a4afdf63f3adc58f39cc2e76de83e19dc580f49870ed28280751603c7a4ed251f125f44e8204a310739525024726eccd48e366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a5cfcbce0cc3af52790d578e7ebe2b52

SHA1
bfc7bb94017b65a8033fb65c928a77155e36ece9

SHA256
997ceac38653cfbf2f7143df238fd0285e6607c72a0084c08bde82ff88dfaf4c

SHA512
05ca39e5a2f7cd2f0041e884a20a085977bb81536f9a4a988e483c45b55114d98ab5b0991aa55002e3c3e3a8804ac3e6b41d0971aa4b78180caabdc768c90f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-4.1637.1540.1.odl

Filesize
706B

MD5
5c9ae9f89699d8c7ddd59f97c62ad88d

SHA1
4a53c502f5453a12293bfe1be0b21b8c27334970

SHA256
ae2c9986f78632b3e3791008e02eba4bcc27910575476fc5c13faef6f0bf4a9a

SHA512
5a5b2e7a1ae37ee3e2fb606fbc549168642e1ec96c1a5451caa7791f9cd82646d95341f74d6f4cf61e7d30aba65850665683876b97bdb293ad45119edc3e8e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-4-4.1637.4440.1.odl

Filesize
706B

MD5
76a34db99589ce99b0427c36696e4604

SHA1
eb7296de11eebb52e889d2cefb48d87a4a78c99e

SHA256
d76cae6fac884912d09597826195c3578117bfa0d349e3387c0c13cbde91c06a

SHA512
9385e3c73e776ed79965e5d4b6d92bf92fbc011f9734a1c1952f79366c98fd33ad3b6e202124287702dfcc5b6972694c997cf7b1b9b8ee2c65ae9c435d1f56a7

Download Submit