d294856177658df0159cfe937e5ea95a8ee8a2ca85754d897aea3bb5d0d962c0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CrackLauncher.exe
Size

102KB
MD5

c137c5f5287d73a94d55bc18df238303
SHA1

95b4b01775bea14feaaa462c98d969eb81696d2c
SHA256

d294856177658df0159cfe937e5ea95a8ee8a2ca85754d897aea3bb5d0d962c0
SHA512

ba595d185ae98152658ce95964fd6bcce7e970896b0b1c674a142d126cf0433094debcd25527d9b4f5a6568cc5a8a42aeaef536166748eea3973f8b694564aa5
SSDEEP

3072:+5OYpgK2+49WqfOIbA099oey1r45340VJ:+jpgFP9W+bAWoesrU40

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
60	discord.com
61	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\ = "URL:Run game 1199748644409184347 protocol"	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\DefaultIcon	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\shell\open	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\URL Protocol	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\shell\open\command	CrackLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\shell	CrackLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000_Classes\discord-1199748644409184347\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CrackLauncher.exe"	CrackLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-17203666-93769886-2545153620-1000\{48CEF835-697F-45FD-BECF-8F9AB1168B41}	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
2504	msedge.exe
2504	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
5420	msedge.exe
5420	msedge.exe
5304	identity_helper.exe
5304	identity_helper.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	taskmgr.exe
Token: SeSystemProfilePrivilege	4336	taskmgr.exe
Token: SeCreateGlobalPrivilege	4336	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe
4336	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 3660	4884	CrackLauncher.exe	84
PID 4884 wrote to memory of 3660	4884	CrackLauncher.exe	84
PID 4884 wrote to memory of 452	4884	CrackLauncher.exe	102
PID 4884 wrote to memory of 452	4884	CrackLauncher.exe	102
PID 4884 wrote to memory of 1624	4884	CrackLauncher.exe	103
PID 4884 wrote to memory of 1624	4884	CrackLauncher.exe	103
PID 1624 wrote to memory of 4640	1624	msedge.exe	104
PID 1624 wrote to memory of 4640	1624	msedge.exe	104
PID 4884 wrote to memory of 4144	4884	CrackLauncher.exe	105
PID 4884 wrote to memory of 4144	4884	CrackLauncher.exe	105
PID 4144 wrote to memory of 3204	4144	msedge.exe	107
PID 4144 wrote to memory of 3204	4144	msedge.exe	107
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4404	4144	msedge.exe	110
PID 4144 wrote to memory of 4612	4144	msedge.exe	111
PID 4144 wrote to memory of 4612	4144	msedge.exe	111
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112
PID 4144 wrote to memory of 4028	4144	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/SDxDej44bY
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff93bfa46f8,0x7ff93bfa4708,0x7ff93bfa4718
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15350799018586713424,16458540749385359213,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15350799018586713424,16458540749385359213,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/sk3d_club
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff93bfa46f8,0x7ff93bfa4708,0x7ff93bfa4718
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3380 /prefetch:8
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3448 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,17847720095936650683,4548971512528335967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:5948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
3012dc015f70b5b1fd436e1f8f6cd4b4

SHA1
ce6efc845e17328506f8101c91065e7809f36975

SHA256
2cb86641b10d0e00d7650d3d2c7e36a522327abde1a1bebc57153890a114f3a8

SHA512
a06cd0aa150ad2f59a2279b8f119e651859b07af033dc366bbb7a6c832b366fd8505180e964592cde83d2662bd69673edd5a14ba539d93974f56781587b139d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
944B

MD5
2bd2c4ef38db87ec90f80c52f1f35d1b

SHA1
305336f052bc850c270d58e162350e9cf8c039f7

SHA256
f6affe18b6dc58c96e16999a6a81b4298c6959ec09c12e112ff04401d38774d2

SHA512
2535ae2a1ac9cd908b414cd4a6a1de78b97d504d8d8453626319e96c34b1fd0ef2d26f954c8e303d25f3080340e9e58cf19fef7c03edec01665e047e232d264f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6caa2cfb09ca07691e23eaca193a4fcd

SHA1
ac0cdf2ec3014fd4d8e6ebdad80bdf5eaaa662e3

SHA256
67dfce3a6b16d8e77390c973e74ecea1c8f820e73e408637652d3668f6ec3345

SHA512
8c675fbdffcbbd80dea19f4595e6caa58ec7d13bb6ba67a49e1ef1c1b1a6e3b6e663bd1abe3930bcb985b61a1805a4242ca99a664f1a5a99a415da9e1e31c7ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4f76859879ab16e17975166c6c4617c

SHA1
e80186f0aee8f4aec1d7c33398c6526b9a71aafb

SHA256
515d91eba7adbe7891a94094d4acb8ca009bfe9a816794e1a4eaf709718e5f64

SHA512
3e91ce205f7df638987aa6ab4fd8490bec18954cf333d41ce95aecbc2e40ab12ea9f85d923187e9be679eb5701cc44fa813c01fbb3129249e0b34a8a47f53e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57ee0aca526ad521eea44a5b7fa9f815

SHA1
08753d29363849316e39abfe6e3973679871ecdb

SHA256
5ec673ac8ff436d9a28d08afa0aeb85eca1558c904f88a786598cd17e029863a

SHA512
0d7e29fe6f7e2d8088ed56724e43964d681361ad36acd174c360cdd85bae2a80be9cc316d59f9e8afb040d43886f68779f6030029011405bf3c6862c24e82b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab7a90b1529f0a7f8c011d0caadb9b6c

SHA1
aa70084eb18ad3ea1887332ae274a7ab97ff4044

SHA256
e181db9dba9a5a256a2f74211e9f9261fe2a086707232e7fedbbb4ccdfb30757

SHA512
7fecd052902d91a687a38a7e8f4675fdf430aec3c52cb5319ccb51de0b90fbcc11dd2d6538518a361abbe1c1a5cea8839aeaa8100cc4482fd7ecad24cf9ce436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
292b403cabd6596ebc48571ade36e99d

SHA1
e63e3c5d79a85d56a0844baa605faab55c4ff934

SHA256
1bfb693edbf9e813c0329e0fcbce735c9b5d0a6807dbcad3a7a5dd1f468d46d0

SHA512
6532281195facf85dc071e09c5d554457add0156786c84c934e9c128fc4272e391409458a5bd71c1b07722b60ce41eea67196b698ecf0574090f0e52f131ebb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d8a33036d8743aef2f653e99ec46565b

SHA1
be822e289662efc77a8428c0587f3f974ba292b9

SHA256
94ad89e5049beec661df0d766af769aeebdc5dd6fa2e371e6a4bba9d3a76d8b6

SHA512
dca3ea987c50fee489b926561a5cc8234ef873a7cef7c2d88f251c68ef3688b8659c249fd988f2fb17e1fbc0e31c90d3bd041605071b8970e94b922afce970a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
862B

MD5
3d6a8f676f9fc2f886995c95b8a3721a

SHA1
eb74636d637d38ce9cb6e78bbe0b5a6871b77aaf

SHA256
2e6ef7b7f5774385025c35cc5bba5fb615b88f84d7b06f3834bb26de09bd5e63

SHA512
30b0a6a1a874c4db03f98e68f8ac9cfc2b953b60a448ecca83da662c0b025f2e72c1abd68a3af1ca2a66093e1a65d1c16b661c59599be66cc251c265b51f05c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
862B

MD5
edf86f8ea68b4b39ddd8e1f5b6fa3bd4

SHA1
c9256c332ee3e72c7c8d893e4a780b7492945635

SHA256
a4dabc8a23461e30d3d0abcdbccb826acfcb6d5440a4c1b24004427a92f76bda

SHA512
dc93d69e2df37285aac7da12df236d4994c3577be079aa73554722a9b961cc1f90c5dcc56c721a503bac6fd5106fdd4c64b8fd04118795a6cdea49ac6d1061b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5868e6.TMP

Filesize
862B

MD5
07ad2354b78b8d616486c507c9e780ee

SHA1
84da337d261d627306e1767c39a234496dc2dcd2

SHA256
df309d4bd8d9a16e631164249ab2c5dd6264e0f7042c4cd6dd820baf2bdf3bf9

SHA512
2ecb26d7b021f72ab4e0aecbf87cace973611624d673c4cc81d98bf7d52ecf0296cf5fcb93a018a099aef4560334831ecd69a4421baf91e3b244e34d75e7abe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d6033beaf698531795c5c30b3d02169f

SHA1
678c27679ea59812fc01379c02ad9bec4e809bb8

SHA256
4a6b3c3dbc3ae01b340d24718f686b10e3bf1380c8dbd207b496c7a5dfd86538

SHA512
fcda88abff4e7c892b301902022e5aaa14eebc135aaa58077df36208b10485598ed3e499b9b418f9c480beade6e8731eb9ba65b457f74cfcb8fe8d0cadb0c838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9559472d14c4f08cc1000d1017609118

SHA1
d0e4b4d1e1d8fa7958ecacafcfd3a373ad7165ec

SHA256
5167f2b27577ec4dcf574ebe949793368b991af738f08593e8e0991d6b9c49ac

SHA512
d30692b812112345bd709b59077845e4b9ce52d7a6c61139ecc1e6a9ea990cd2e16f7fa2d62f2a2e9510e35efb759e8feed5fbb5248effdf9dee01fa4c2cc15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de34e38f9c74fb8516d1a0989f07718f

SHA1
28c8ccf8bb232f87d1f23fc011f7ee722a5f516a

SHA256
ac6f521589a9d5268fd374e6a56071b0a831eace3cc19197b8a925dad43bc857

SHA512
0973d717384b69873f39716fa9d1d096fc61d8b20febddcf74d36fb2e3fef5dcaa17c818123425772c2ba5c003aa375c71c620d71e62ca7c479cbc35008a608e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/4336-290-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-289-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-288-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-287-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-285-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-284-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-286-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-280-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-279-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download
memory/4336-278-0x000001F565B00000-0x000001F565B01000-memory.dmp

Filesize
4KB

Download