2265c5467f4019b97609fde648b82c537ec7f1a22787a6758858c431e4e2e898

Analysis

max time kernel
68s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 13:48

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

sample.html
Size

49KB
MD5

3b76987ac6be212cc8f20697b8f07cf9
SHA1

f337a3e6d8f60ac81532cf9e777d59c5eb800044
SHA256

2265c5467f4019b97609fde648b82c537ec7f1a22787a6758858c431e4e2e898
SHA512

1d474a2eedd3c3aa11e06d4bfafe560c5e75706f32e043508705931cf2ca159fb4bfa9f11f859186d85c430bcba0701169dc4b41ad2f0b63d7cd11f2268386b2
SSDEEP

1536:Et6VhMNkb7yNQgzQF1rj3eIdsSy3o6qOb4:BEheJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
2400	msedge.exe
2400	msedge.exe
1460	identity_helper.exe
1460	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
344	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3372	2400	msedge.exe	86
PID 2400 wrote to memory of 3372	2400	msedge.exe	86
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3032	2400	msedge.exe	87
PID 2400 wrote to memory of 3840	2400	msedge.exe	88
PID 2400 wrote to memory of 3840	2400	msedge.exe	88
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89
PID 2400 wrote to memory of 2396	2400	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ef2d46f8,0x7ff9ef2d4708,0x7ff9ef2d4718
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1837101073339181209,615006093933222836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3964055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
49d5c5a862c5b6f67bd47a8f0fdbed73

SHA1
584f838ea0da5066011a44b82baf93351eb42a73

SHA256
9798bd8fa75eebbe7a960c4dbef2fa1769eb2a67de240e1500d2010525d2705e

SHA512
5d72332e2b9ee634a706407742b9d86f3b5b67fd0692545d3ea9a022447c4a188930a0e6d4af8870a16b86b8235d8331c7bbef4f674ff3b0ec5104ae6dad6ddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6e5e3d543a05efb772d84e755a38f1d5

SHA1
ab537c67a6fa10022596f05bc513a6fae3313664

SHA256
609e7c1f8bfe46dc3187a62af21c047c2f72e700ba9259019ef00268bba1788e

SHA512
8f4c686978e763d8f78b5cb43d39cff554839c413edd5d2f6116b90713fe343bdbb829eced702a3fe03ded9fc06f92258c70bdb7a5f6358bc00ce0648d46f97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86d8a44665864f87433d9f8ce1d2d540

SHA1
c608db619c6d53b46ab14c2d099583fa7c2f4b23

SHA256
8c8cf7c0dfc547beab07bb76fe9e6acd1acfefa85d9066f463d274e20665d809

SHA512
2064144d41eb23aa8fcedb22d9951e99377ff39834752d99fe8f2d9f2851cd35c8237a549742d4d80f59d4ca7e52eddadaa371a9401a91a4fe31c0dc7d469952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9d4b5d47ab5f93954bf9f725eb610b2

SHA1
03ce0cc6c50c40d07786843386c4396c440794bb

SHA256
4c0f94b320a0030a079e52b445dc4bcde751828dcb10638375c5066599d07340

SHA512
6c676d486b7fbd48fe8d41f6647dd384cb9cacb6ef93994a75722a8e470773b66949d985ae5a894332721246dd6ce0d1f55812416fa0d754a62bee36106982fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
91ed02e194076fedeaff1eeb417b4275

SHA1
0388cf42bd682ea992faca6baf23f2832ba0679b

SHA256
a19ffe07b9cf0e322bb05330c9ae08a8f352687731435c0b7ebe88893dafb327

SHA512
74497334ff21868b165f51591939f04401c451c6edcfb4358c81c8112120a0709f77e9f83d65347a5f1717a3f18125b082173e463ea523cf23acefe56fdf906d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
dff0560f5574d8d9b96adc7204bb94eb

SHA1
b0ea3d3de8077b219a17f1db214e07097c8982a2

SHA256
fc3b52fada461d0fc0cf77e58b90bec383fbd4b248e4c14126609539d25237b5

SHA512
4494234c00158a3371629495084fbfccfb1873819dab51046e423696870ae6df6ca65a9aa940a22d711d15d33bb40e7dd0b38f3a77584e990b157070accc92a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a98b8524df7ab3ed4bb020af54344513

SHA1
b858414f4acd2e7516feff0c12e562e11e2b0252

SHA256
55a72701c855f5a41b5d2a5fd0be72ab318b19ae9f32d77b673fc00f2ac33eff

SHA512
170a3c270bd7e8b1221f2aeeebdf161a773f8302d8f9d7895c534e8ef03c460ef9f0c79abe9845019a7c9311b225cccd1464fc30a7468adf34937a22dc430928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
69ce3da43511bdb2f33d4fb357fbf59c

SHA1
874616d5a18cc77f14ecc9ad1b7b6e16e0dd7f18

SHA256
a2357939ad66e7d517b8443bdbd22a77f862112d35417a0eef0c6335a83bc2cb

SHA512
41d85559e866fd54cb9fe92910c8cadc46887bf1a0f4fd22d519c52b4d3f67ef278c25e2abbd89f11dc9076421799cb953106bcbe88f9cbac9903de1ff8cfea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fafa.TMP

Filesize
371B

MD5
cb7ac067fad8f8c0fc33eb041d3ff85c

SHA1
6b13e1b8e00c32a191c82e75f04920b323b734bf

SHA256
849b583ddbbb7abec1ce0675908898b2f4230e409348efae3e1b7bbd5e8bfd86

SHA512
b4d2a2e0ba894e212ff732329825f46a464fe376c97cd13da8747db1d455b14de21326160cf0a79ae13b5ba200100c89340f61c86c430d2fb18fcb358a267590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5eec3f27efba52eea94181c388eb6583

SHA1
ea424b03fbe68267235b58793b96a44dca3e0c01

SHA256
59a8cc3f35f3166347a8688b9d268e0a89f5f6e2b75bc2a8d9e91d23d53e6093

SHA512
f427943d7bcc8c2330ff6130412bc7f5e95aa2bc6a7e293f5fd57833b86aea0b29332367f8a2c9f172564adb9707af75514befe05d56138ed6485db7dbbfa751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
09a98b81d01969253fab62885453290f

SHA1
67f6024eac09f3119d054d6598782959b86baf71

SHA256
bebc1b4e5678742e415bb0d7e72561de5e4dcac129f0a22eff4e9f2a1f20b060

SHA512
019d9387e98e8f0df4a6f8ee648bf023631eeb0c9f02cb7c7e77c63798963ec5eacc7ca2f1855694ad4f0750f77c5ca78511f7df066458cd3908f989e87e4e35

Download Submit