hxxps://workupload[.]com/file/tRTLHpYs4xN

Analysis

max time kernel
1761s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2024, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/tRTLHpYs4xN

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4800	winrar-x64-700.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1132431369-515282257-1998160155-1000\{73DC4366-1295-4C65-B072-3FB2DCA0DCB0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 533831.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4148	msedge.exe
4148	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
5688	msedge.exe
5688	msedge.exe
5816	msedge.exe
5816	msedge.exe
1128	msedge.exe
1128	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe
6120	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2180	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
6044	OpenWith.exe
6044	OpenWith.exe
6044	OpenWith.exe
6044	OpenWith.exe
6044	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
2180	OpenWith.exe
4800	winrar-x64-700.exe
4800	winrar-x64-700.exe
4800	winrar-x64-700.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2576	4148	msedge.exe	86
PID 4148 wrote to memory of 2576	4148	msedge.exe	86
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 784	4148	msedge.exe	87
PID 4148 wrote to memory of 4008	4148	msedge.exe	88
PID 4148 wrote to memory of 4008	4148	msedge.exe	88
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89
PID 4148 wrote to memory of 3096	4148	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/tRTLHpYs4xN
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5b1b46f8,0x7fff5b1b4708,0x7fff5b1b4718
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4660 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Users\Admin\Downloads\winrar-x64-700.exe
  "C:\Users\Admin\Downloads\winrar-x64-700.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13478837301383342251,16060961906865534814,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\ef0557c4a628476da1e3755166623bfb /t 4244 /p 4800
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
35KB

MD5
3f0a3329015911236cf93c2b20ceb263

SHA1
75d560d378e180108d86409b1bf8ecf63da04b90

SHA256
c097c93282fc1f37a00b96a9fd68a3e6a3d76177747a1bbbcd32495cc5f20e04

SHA512
d2849e06aeba4c125b1be57b0a688e00c326f651750c77dc2bf9967e944d0b7f550309498d4cd95819484a5c3b6d2352d5786f1595e040f6b0b058b5d94748f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
5cf36b4c4fe7baf2425c9673f66567c3

SHA1
b8bd64431515bc29f2ff9e855423a5e8ca7c7ba4

SHA256
55409718adc376a795b5aff54934b77810a0598c3995a977c88c5269621b10e7

SHA512
d5e11705edb44408e7e1d59b6ff5cf1f55bc83e8e9d3dd532b9331e293b2e1174b6f1f9a04423fab90dad02ad08f861e7ee679850dcb80c3b90487b1eceb0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
4f41a334d5d19dc1dcdfe785023e9e0d

SHA1
08f20301c3f37795963684a88c1959247249b060

SHA256
5ec4747972eabaed12af716c064cf52899fe4ee8c02280fa397c5812e6dcfb90

SHA512
fecc60f5bc7eef3b609180926d04680942ea02be098a10a65d79c50cc47a65f4500a32fcda1fae7d71e79d4516d9c632f9642247667bfc82e7a4cdb3274fddd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
6bd5b2eb614f4083fd7d2c243cd2c88e

SHA1
c74dd4c4b02eac35b5b6de981e87b406518c325e

SHA256
0f2165b1e3d622c310d6cf3feec5f06932590bf1ace0a5a6c74117f339122748

SHA512
3772fe4ec18026115cf5a60ad58902f3465a002ef3b9515dcea331095622f37eeb9dea8793802de218e464baffa4a34736dcd47bee0af31eed1b90f2fa1e05c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
919B

MD5
86706b0ac855495bf7c4511c78f98e4b

SHA1
e3af4b6827f8c7c84290c2835ff17c16fee683e3

SHA256
7ecb712321438e05072a147c0f5564be630e5508d40ed793fe648232a197f1a2

SHA512
89dc412b930bcae0ef3763726ba4186ed628ba2b3a0ec5cba81e9b0c5f37c23968327c68236b166dfdbd8b9812b00303774a97730591a8fdee69e504755f2352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f8532f71ff6af7baae4d0b0f5f697d7

SHA1
b4c99afbd64eab45fc35864dfcd44ad8af07313a

SHA256
a6d87835410fe19b8afaca6d795d76f2228d62ebd6699933d31636eef900bc09

SHA512
2570ffa71bab4e966a0e2949c18f2159046a6129f4c39de9220a87d7723208110fb09d5b2e47a2051a0816f7050b4a242b1e3a79d8068d51d88b8fb581e9f42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f697124606ad3affe63045ffd805aa1f

SHA1
855c7dad213d0e22a087834b52be9e13064f50b7

SHA256
1abeab1b7def73d9e5cd236ef368048456af26d76cc7b27af2adbe53b09d66f6

SHA512
8469396558d14cd10cf160c938c06bee291c06d4eccc45f6ae87b3980bdbb16087eb4e432c6e7c86451cb1fb4b73d59f8c2b0f19ba5233aa3e8ad99f5abc4034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3d2ad92e119154225397db42e156ef88

SHA1
9054eec39992c86afb2b2bdcc9daa48b31dbf2c7

SHA256
8e07ee7b2be0d6091a4a85010a3bdc89dbc9b8794f805999b80883ee5f243f8c

SHA512
40f3a6e26c17f631b4701bee35aa60da8d058749ace8c357e4b3f1f607e712bb5153725c2def1ce94f45b27e0ac3ff5a11a54652ceb8f0f2e247842233e8c55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
beddd9c36283ce443cc5c7910447b627

SHA1
82a8994dc58968a2010ce2e3922ff7f5ff49f5f0

SHA256
9639029677de31a92c42d9fad8d06374d8fb80d006b9bb09d7e433b41788cb03

SHA512
a3bd396881d84067dc714149a94612112a808a3244d893c903fb3c387583523576cd1bc764379447b13ada04a6dae47eaf3388c5a714ad284c30d2af596208e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5806e1.TMP

Filesize
703B

MD5
368559cc78e53290b11ca31ef8bcacbb

SHA1
6ebd12f9e64d48358a927961a64e58f7f0dc60a9

SHA256
79eee0b4880e1dcc52eb47446f5cb958915272b38ddd33c88c6c420bdb160c21

SHA512
23a508477d7e7beb9ff70062e70065da664986c85d39e3195a109034d27cd7841517a5c712bf5bcf2bedc31671085813e2ad1ef2b1ef8855b9a1d03fc06457c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cbeff28ccc7ebe63446fa02e40718f2a

SHA1
da1072fa44db805592fff81e513c05ba5c19e6e4

SHA256
3fc6bfb24ee77047e81b29225ab0e235be9b85f8b9dbbcdc25a2be74fef93f03

SHA512
6adfe54a9f5376190f5cebd4a8e799adb31bd93b6b53f063eae990b3109a366529ff5dd98961a133fe8fa85a951c46077d103731b3307009c74f609b738f889f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fcc533b7986fc2be76ad83844ce3e04d

SHA1
ca978ce45a3cde082a4ff34f707399fec45f2ff2

SHA256
56de1db4dfc53786637cb96cfcb3b9edb000ea3349dff7a8b0651261ac467f97

SHA512
9afa8375cecbe7a12c055163002cd924f2b8213f9653edcce2ad0d0cd29f7c5f1bd99f2f32cb3b774af22768e2ef9b555c5bf95686bb8cbdd9dbaddb213c2357

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 921568.crdownload

Filesize
678KB

MD5
3ca55a44229e25b29aa7a8e9a21271a5

SHA1
574cb30352e91005f45c3a3de5dc9c9031feef6d

SHA256
42711d838a25de4cb57d15e9cb70b58ac44480c9fa9947d77aa2f9b0bbd4c0d5

SHA512
6299878b74f1e5e75f2c21733331a73c0b415fb2828d8213e8aaf1ddd76520e98f98f74cb42ce11a4e4c9c1a5e58dd8063cf76af527e76adcdbdc013bf251160

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700.exe

Filesize
3.7MB

MD5
fc7776eec30751e169e1089bc2a4c478

SHA1
99cdb78719ca97c7351aa75f1566224396d9033b

SHA256
426b7b38ca6de20f1f6535d2fa63c16e11780c7cd5f2ebc66ff9a0022e246e83

SHA512
bc94f526d4dd751a44071dd6f540f2957d96f5c6500d7e5bb41ec6581bb0a584a6bb91fe13f7a1d9c7749c4601b1fe95f2a12a204b73bdc9a37c83cff7ac35c3

Download Submit