hxxp://cheetohub[.]xyz

Analysis

max time kernel
1680s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://cheetohub.xyz

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
944	winrar-x64-701b1.exe
4308	winrar-x32-701b1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{EFFB8C11-2FD8-4859-A7D3-6712D197F8AB}	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 869665.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 689134.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 751591.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
884	msedge.exe
884	msedge.exe
2680	identity_helper.exe
2680	identity_helper.exe
2992	msedge.exe
2992	msedge.exe
3268	msedge.exe
3268	msedge.exe
4844	msedge.exe
4844	msedge.exe
6096	msedge.exe
6096	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
944	winrar-x64-701b1.exe
944	winrar-x64-701b1.exe
944	winrar-x64-701b1.exe
4308	winrar-x32-701b1.exe
4308	winrar-x32-701b1.exe
4308	winrar-x32-701b1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4684	884	msedge.exe	83
PID 884 wrote to memory of 4684	884	msedge.exe	83
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 4664	884	msedge.exe	84
PID 884 wrote to memory of 2608	884	msedge.exe	85
PID 884 wrote to memory of 2608	884	msedge.exe	85
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86
PID 884 wrote to memory of 4424	884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cheetohub.xyz
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff956ee46f8,0x7ff956ee4708,0x7ff956ee4718
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Users\Admin\Downloads\winrar-x64-701b1.exe
  "C:\Users\Admin\Downloads\winrar-x64-701b1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6096
- C:\Users\Admin\Downloads\winrar-x32-701b1.exe
  "C:\Users\Admin\Downloads\winrar-x32-701b1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4625746441876753949,11986973030179397842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c610de3bcf19409db9276926e7805da3 /t 4400 /p 944
1⤵
PID:5316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1946d8a64616205662e095d1bbc041de

SHA1
6810e292e378db693e83b9bd0b983ae044c568c5

SHA256
ef91e64c1978aaedc7e61bd5a1c4f628e7b7d98d89dcbdf4399ca57e95df10d3

SHA512
d610015de090a79e8890e0532cd666b0c62881f9928ec132ce4fc819d73e8d198aed7132625402ab8542c0751cb03e89c16c7a938c0595f57b31441b9551d56d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
129d89cc9a6dab3c9d00f187447ca578

SHA1
0068b18c5e3ba8564593292ac99e77ac16d4e21a

SHA256
bf57318ce8b18e3158c880fe5c53f92eeb2d7154c615f78631410dfe6d7371a6

SHA512
703c1153157b598486f0f6cdddcfea1fdb593fa595d98f6d58ef44c20b8799eea2733fbf030bfb1d4ce438436e1e73710ffbe80c9dbff310cb7c170bc1ba1bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5601e666c689efd016627d48e57c94b6

SHA1
416493ec4917352cc4f9866cbdb5b50549a24cd3

SHA256
bf8aba9ac9ffd03fa6de8e756f9dab4d376ad5f622ae126de66b8ffe9392ee7f

SHA512
7478eb707fbb67f80c05377fc5b9e8faf5df2658a1ce39f826ed6063f9c4e02bf19e1dde9d501cf2c50b606b17a9f469aed7db831a767d1a510a140838a558cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f71abc275d8f28467c32ad68ac945e7b

SHA1
8186ed6a4251b2a5c8e3b65ef722e920853ed102

SHA256
769a756f0aa015c828edd3f967fd15fcaebf5ce4ec928acd979b20a2db54eeeb

SHA512
100763d604bf393be094d665b5f2ca985ab1372b850f58641c4976cf435bbd14c2424866456a56f72618acde860df59990cb23b2110457e801243ffe428c07af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0040ce49afb34af2c99aa0d0db49d30c

SHA1
9a8727931aac680ab44649668e0d4e9c4fcc6222

SHA256
f7f667c144672dd57eee1b6fabf7b548a68c07d03190879cf25ddf3559bdbafa

SHA512
b7523605a0086e664cdcb5bd5832e74d8e683bd77430d9dc6779d68d4debb7e80d41d0a1f5993a2f1698f3e2f96b2391a0daf1df00cdb85c5c71ae16b8384fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0ebb718d52254c6fd4a7d7fc657b86b0

SHA1
0238190b908e76e14d52eabfb131a867650ba7d5

SHA256
8b6bd90bd86cdea90aa28fc4804ac73c8a98feb2a5aa51dd066a9749c624a9aa

SHA512
13b0b07edcd317cb47c7ff4ca24dbc34b6dce9a27a772c2bf8b32e10a72033fec1644e0c723c2691fb2fb9a9daf0e855b763fc5db6a12a7035d5d6f656996b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
dd8bed539e14ca8f6e1f88738feef847

SHA1
3776aeea5feda7ee9d5d7e1fdd5a858644c1ef70

SHA256
d7e08cd8510706ae63513ecd5968ab3b1b97d46aa3a7df1563236cdc09daea18

SHA512
711ca8a9665bf8bdc72d3729eaba5e395ab7b2b6f9c51e16f6e44f9aa1f0a9c14aa6ce226af8d71738297368578f058df375b558c184be455a90b9bb53fec8c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
8529f8494ff4cb2cfdd1c8a069cbe5f4

SHA1
47d7435abd102b3a15e9196d4d600d10934a7dd4

SHA256
61ca5c95db9d10b58a0c7ba6b01c8ee2b1d3e958967d4335613223c24810c0a7

SHA512
f1bd8f3008cd4f5cb673c313284b7adcdffd405bc699dc5f9f62483af558e31982546be6f641314c0f3141a0f0c9372631cb005a5d61006688946fb5164db757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5799bf.TMP

Filesize
203B

MD5
a5d673f5be769c262e15d3e9a0af5caa

SHA1
888be73ba237c35c71533b5ccf519e3a27bdfe2c

SHA256
c41d69bbaa4c8cc48dc70bc763f17452d4aa7c8b0feb21629e4784b9aed69a61

SHA512
f1146d3cce64831467faf414fad84b3ad444349000417539e43e2d0b7b9078f3949168a0caea53385bc5b1d82a05f5128cce615638dd9d08059f254679e0b024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
737c96432677099e89191b889a3863ea

SHA1
cb0273652b38deae2d76e3551e28048207f1e9bd

SHA256
27a7bcfa555804526677f83de37702a6e443b1dcab6d0e0c12246b78ae319fb2

SHA512
5ce41f05269b56d7bcde62f59ad27c65fc31c97111a2b6abc5fbeeaa93fc9dfa707267cfe047780d567758bfded01cab7cd4095822e49133c7e9ae4dcdb0e33b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b3ab4c79bf24f1cbc5173cdffb2bf9f

SHA1
ccc5bd7e6df46ff48eb63c665b67b4185d1a06b3

SHA256
eba087390de76df46ae77056edc7512c95a722febe1a05ba8cc06551b4548e73

SHA512
0166d204d14e1c41bc7e69fb469c1cf8612b41f4ea74d43f3126247d7c6fdeabaf6a256ec4c7249eb07d47e05234dfce67df4458fb38a0c54f0eb240e6c3894c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c3327f30ee10e835ab726ea8004b2667

SHA1
79aeed035d7d4e593541b9835e0a846cd4a6dd5c

SHA256
73f44fea3bbc56942f7fb4b817579d4519be905558b2d751c8babf9b8351669e

SHA512
1b009cc62583ed4a7cb558a3e0f38c34bcd400d530d6f6a3e5bf1da2c906408bde2bcb067da709d908afd36dbb6294b28e1ac4aa6d48dc67109a49ebd14a1569

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 751591.crdownload

Filesize
3.4MB

MD5
4ae1d9f5f81310405c5e310fb250453c

SHA1
941a2bf9b11c8ddab892f1347133429c014f9091

SHA256
4406521868b7d673844eaa3c2ed77a53698e8e38a19b37cd0655bd0769b977cd

SHA512
5be4b61fb12128be90aa18debbbfe8ecbb65ef6b6cf5628cec911ace861ce78ae048728a47db7457a9abbd170f64edb30ba77bff06f6378a310f37349474ee30

Download Submit
C:\Users\Admin\Downloads\krampus.rar

Filesize
88KB

MD5
ac2503cd31dca53357a49e68ea6994e2

SHA1
b02ab0404058ab5798c5d94eaa51034ea4e83eb8

SHA256
13a4c84d238e679f337b702d33299fa75d921d4718ca5bdb9ed4fc2072cf627e

SHA512
580bab36de6f7bb8c8756a0159c59a21b46d479457f7e3fe18d6622b0651f49f6f8cbc74f32a6dc42259a61a388011abf8fd19857f92c4469cacdc35d41fce4a

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701b1.exe

Filesize
3.7MB

MD5
60718ebf4145c8d99cb686e6977b8ff7

SHA1
2b5cea0fb9cd4999bd1de751e8aff8325df69fe9

SHA256
aa60a7d12146469e2b52eae12d29af83639f251efb8811e70b79d7c6fbe7a13d

SHA512
1bb85f7a0a8646dc3af84a43063d7ea11633ac027e30f8d38dfa295c2327603ee1339fd43ec6e02dfeb85107b76f6419262772e75f0f3cf875a216c97f422469

Download Submit