hxxps://cdn[.]discordapp[.]com/attachments/1223199506984603718/1224792127733760061/BLOX_PREDICTOR[.]rar?ex=66313c8e&is=661ec78e&hm=d030074c56b8c33e7b43d3139f8cd9b1501809d1d609c1b2a898663d7d5377ac&

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19/04/2024, 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1223199506984603718/1224792127733760061/BLOX_PREDICTOR.rar?ex=66313c8e&is=661ec78e&hm=d030074c56b8c33e7b43d3139f8cd9b1501809d1d609c1b2a898663d7d5377ac&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\Registry\User\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\NotificationData	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000008c58f973110050524f4752417e310000740009000400efbec55259618c58f9732e0000003f0000000000010000000000000000004a000000000052c77e00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\BLOX_PREDICTOR.rar:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2716	vlc.exe
1284	vlc.exe
2052	vlc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
4036	msedge.exe
4036	msedge.exe
3316	msedge.exe
3316	msedge.exe
804	msedge.exe
804	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2396	OpenWith.exe
2564	OpenWith.exe
1184	OpenWith.exe
2716	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
1284	vlc.exe
1284	vlc.exe
1284	vlc.exe
1284	vlc.exe
2052	vlc.exe
2052	vlc.exe
2052	vlc.exe
2052	vlc.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
2716	vlc.exe
1284	vlc.exe
1284	vlc.exe
1284	vlc.exe
2052	vlc.exe
2052	vlc.exe
2052	vlc.exe

Suspicious use of SetWindowsHookEx 51 IoCs

pid	Process
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2396	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
2564	OpenWith.exe
4288	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
1184	OpenWith.exe
2716	vlc.exe
2924	OpenWith.exe
2924	OpenWith.exe
2924	OpenWith.exe
1284	vlc.exe
2052	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 1132	4036	msedge.exe	81
PID 4036 wrote to memory of 1132	4036	msedge.exe	81
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2496	4036	msedge.exe	82
PID 4036 wrote to memory of 2064	4036	msedge.exe	83
PID 4036 wrote to memory of 2064	4036	msedge.exe	83
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84
PID 4036 wrote to memory of 4996	4036	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1223199506984603718/1224792127733760061/BLOX_PREDICTOR.rar?ex=66313c8e&is=661ec78e&hm=d030074c56b8c33e7b43d3139f8cd9b1501809d1d609c1b2a898663d7d5377ac&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9f9e3cb8,0x7ffe9f9e3cc8,0x7ffe9f9e3cd8
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,6199998592108574539,10248061660153173387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4288

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1184
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\BLOX_PREDICTOR.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2716

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2924
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\BLOX_PREDICTOR.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1284

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\BLOX_PREDICTOR.rar"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1a9c7fa806c60a3c2ed8a7829b1461f

SHA1
376cafc1b1b6b2a70cd56455124554c21b25c683

SHA256
1eb39b1409ce78188c133089bf3660393ac043b5baade7ff322df5a0ca95380b

SHA512
e1cb2f84b5cbd86b107c0a9ec0356ab65a54c91208f9f8e83fec64bf17ae89356a09b0cd39d2726424f4041d7b25b962c23672b8645c2e10f11ff4d2075f4afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f3f6e86c8b7bdc605f5559df800bfd34

SHA1
862d05bfba760ae8adcbb509216dc18ead59a6b2

SHA256
5dfe9be21d4916615025055f1a70151362bdb404b40f074685e39b33ad545a78

SHA512
de576ebf0cbe1c5e7639c42517253796cf4b5770298271ac2e6958404998f2d6b8e3378a535f2f316f4020fd8e60b5cc9c1b6b5171d307ca3215afe8ac47a7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73ea149488f957146b5b2fb720cb0b60

SHA1
d60ac0da1f63a64a940a9149c1aeb19ce590c8db

SHA256
8bddde72cf82354b5c357258a0a78749eb75d6b1cffb936abf24cfc3ff533740

SHA512
4b67735569ee52454323743ce7176d46d608e80f2bb5fe4d6d040b5080294a9b0f47731a4188c272353c9bc5f22a34638c0a32069ee09c968b2c856b17d8d9ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e96850854741cc1739d9c9cd71cc1141

SHA1
2a5dc9da9f631accc16ec95ebfa6c0bea051b86f

SHA256
061e434df9320e949feabab30b1df032d284d69824616fecb56b1a1712a8c535

SHA512
0c87fc3aabd13576bedce03bfb3bb31277cb30fb797af217bce9bbd84dc088f19b5be51757f713fa474c7c79df0f97c86207379e33b32e7bf517c4de6cf118ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1af809d48a5b56a4bae1cb94a7f90ada

SHA1
fd03626ff1cc14b5f6722daccb0d342bf853619b

SHA256
ca2a2027679db2bd4e4fbefab9076a702f97ea7031b2e82f443ff046a746ec61

SHA512
14906eb1e5ed67b9b6896ee2b0b3e90292daef1aac046f8c2e397c445421886eae0dba526014c5e68cfef78c529a09789c4becabc1a0a1bbb5637c48c8a635f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
29841ed16ed7be753c9e1f51f832607f

SHA1
5652847814d7123dddbb2d7ded95fc851a1c4750

SHA256
60716a6ebb0ddad0f8c0398ae47d3026fd4a53f98adad286e0f61201be7cb2e6

SHA512
2a9c2ffb986249fb32cf9a9bdd852ebefa8d328b74901e36c220ac2d2060b58497072a41dcb0ffbedb001cd7e45f347686f52112e32491e7d9538452a32d76e6

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
530B

MD5
fc23904a206a29a61fa669eb7cb6d84f

SHA1
450efabb51681ccf722fecb770af0836bd876634

SHA256
00e33015e11d980af18c99f1c7f4d4ebcbe76bc1e435d2f0185c0a662a9625c0

SHA512
54810796bed3cb2c8ae3d1e890c6d516fd1b105a27398072f7ba254b2a4b60e0e045f722e4a859a6cac5c35b2aa1294ff0a8470973f49cd6c6c3ad36c701eaba

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
732B

MD5
ae10b2b80da425fa6b03ee2466f48870

SHA1
0b9bd653d9743d56d9eeee23a824348ffc0574db

SHA256
06909894f849603b4ba50aee9119a5a560c95ebb92609028c7291fa1aa8c9e67

SHA512
d4b8fbf3801546a7d91bf5da80e96a565ce75837a9872f10f22a7dacd34fb8613820d95580f1677174c4d9f194ba8b526db90e3f9539ca31b628ce368b7a80a2

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc

Filesize
94KB

MD5
7b37c4f352a44c8246bf685258f75045

SHA1
817dacb245334f10de0297e69c98b4c9470f083e

SHA256
ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

SHA512
1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

Download Submit
C:\Users\Admin\Downloads\BLOX_PREDICTOR.rar

Filesize
7.3MB

MD5
57812dc28e33897f6913dc0de97e938b

SHA1
f5406484c2f3d176109e63ef8c2b13b2e20761e5

SHA256
d999ee980aada4467c4da64bcc9347352dfe911f60991d46cf7bd7763cd99742

SHA512
3cdb4d981d3f60e58c3b5a397decb4653a6f3752dc6b843ed7a1edfcfda43c6cb9d0d280d789abf6e4c959292e0c0ce1d78d672a303606edb0493b1d82d599ec

Download Submit
C:\Users\Admin\Downloads\BLOX_PREDICTOR.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1284-135-0x00007FFE9C5A0000-0x00007FFE9C6AE000-memory.dmp

Filesize
1.1MB

Download
memory/1284-136-0x00007FFE9B470000-0x00007FFE9C520000-memory.dmp

Filesize
16.7MB

Download
memory/1284-134-0x00007FFE9D9D0000-0x00007FFE9DC86000-memory.dmp

Filesize
2.7MB

Download
memory/1284-132-0x00007FF625BC0000-0x00007FF625CB8000-memory.dmp

Filesize
992KB

Download
memory/1284-133-0x00007FFEA59E0000-0x00007FFEA5A14000-memory.dmp

Filesize
208KB

Download
memory/2052-186-0x00007FF625BC0000-0x00007FF625CB8000-memory.dmp

Filesize
992KB

Download
memory/2052-187-0x00007FFEA59E0000-0x00007FFEA5A14000-memory.dmp

Filesize
208KB

Download
memory/2052-188-0x00007FFE9C720000-0x00007FFE9C9D6000-memory.dmp

Filesize
2.7MB

Download
memory/2052-189-0x00007FFE9BFA0000-0x00007FFE9C0AE000-memory.dmp

Filesize
1.1MB

Download
memory/2052-190-0x00007FFE99620000-0x00007FFE9A6D0000-memory.dmp

Filesize
16.7MB

Download
memory/2716-113-0x00007FFE9D280000-0x00007FFE9D536000-memory.dmp

Filesize
2.7MB

Download
memory/2716-114-0x00007FFE9BA10000-0x00007FFE9CAC0000-memory.dmp

Filesize
16.7MB

Download
memory/2716-115-0x00007FFE9AED0000-0x00007FFE9AFDE000-memory.dmp

Filesize
1.1MB

Download
memory/2716-112-0x00007FFEA5BC0000-0x00007FFEA5BF4000-memory.dmp

Filesize
208KB

Download
memory/2716-111-0x00007FF625BC0000-0x00007FF625CB8000-memory.dmp

Filesize
992KB

Download