1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
Size 896KB
Sample240513-xdvfysab83
SHA256 1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be
MD5 f22c3c68146ffaf6b04d6104c1cd7017
SHA1 d0558cadeb111a3783f9d377eb1709b891d97b84
SHA512 c0d8c81f4d23c8fb4e9572a5ff751a9a93f0f7c862c06b4b8843c7c904598fd68567b9f98449075db5e163ff90bfe52cb60f1bada776dc06132badf30dd0fe7a
SSDEEP 12288:PqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganTj:PqDEvCTbMWu7rQYlBQcBiT6rprG8aTj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
3576	msedge.exe
3576	msedge.exe
5644	msedge.exe
5644	msedge.exe
1028	msedge.exe
1028	msedge.exe
4676	identity_helper.exe
4676	identity_helper.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3576	2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe	82
PID 2668 wrote to memory of 3576	2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe	82
PID 3576 wrote to memory of 1512	3576	msedge.exe	84
PID 3576 wrote to memory of 1512	3576	msedge.exe	84
PID 2668 wrote to memory of 3980	2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe	85
PID 2668 wrote to memory of 3980	2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe	85
PID 3980 wrote to memory of 940	3980	msedge.exe	86
PID 3980 wrote to memory of 940	3980	msedge.exe	86
PID 2668 wrote to memory of 3732	2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe	87
PID 2668 wrote to memory of 3732	2668	1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe	87
PID 3732 wrote to memory of 3064	3732	msedge.exe	88
PID 3732 wrote to memory of 3064	3732	msedge.exe	88
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 5440	3576	msedge.exe	89
PID 3576 wrote to memory of 4332	3576	msedge.exe	90
PID 3576 wrote to memory of 4332	3576	msedge.exe	90
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91
PID 3576 wrote to memory of 3916	3576	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe
"C:\Users\Admin\AppData\Local\Temp\1025296ad73c142202aded763f95657fcf821107e0947247cf41ca24c8bc95be.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa682d46f8,0x7ffa682d4708,0x7ffa682d4718
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9188874939644127157,15500119646001555778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa682d46f8,0x7ffa682d4708,0x7ffa682d4718
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,2798763274847881776,7475017442218467755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,2798763274847881776,7475017442218467755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa682d46f8,0x7ffa682d4708,0x7ffa682d4718
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,13379535033952748892,2874999880077445878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 32fc88b6a7779662b60f84cb65ddf5be94d8cfc16dcf014e322e056405c1a3df
MD5 57086b38254e319f60e6b7a51ca84d3c
SHA1 4317ee11617b2e24e704b0ed53386dfd82855948
SHA512 2d5399b25a382671d7395756cfc0d2ad079e3f19fbfbecbcbda28e8b47bdedc0b23f540ee0036a62ad30768837012bf16ee1505317eef49e658a6c2978185aa6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 f98536eaef41b80411cfbf98a2b53ec79cd6ad38ce32eeecee46b908d0c0fa3c
MD5 4bd65e595976048c6c24d58e002607b1
SHA1 513b31763e45d3b84350e9ed062ce80b96e0ec25
SHA512 af85417691e5d95265777a9bfcfa029c3d49d66fb66d0eef3c5c09c206a93a186ee764b4326a6009a17b1196f695b2306316f04f6bd6de0431efcd0a437f6421
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 43488f4b8fa20f2428669fe01802ec2adfa2ad1bdc5562f33d1914415bfab960
MD5 f5e0fad99e76ee5824ecb6b01c87c02c
SHA1 9b68058f02ebda12c3e96e8196eae8a7db705751
SHA512 fc2df0f1045afdcafe6c3b99bd05a042a36c90ac7fd039b84de3342af1fc2cdcebe39d083c4b7ce6dbc984fa12cb553828f4b350bcff43ecd30788a6088fc3ad
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f63603498bc7057a1c0f594ef8483671029572f10c4a30c99a5ee604d65533aa
MD5 cfa7ecbe4128fcaa5c39ebb28c61b84d
SHA1 15d977b6ba8ba064512c5f8212f07bc5e41fdab7
SHA512 53cf7b1c7d00dbd1fb8a82f906cb344257a075ff6f3811ef3605465b009eb0e5596a232cf33a33729ff4c90ddbc0a87e366a70369182363661eb0e18de0027c2
SSDEEP 96:nekrX1d2z9wprZ6WweWMoiVmdebuJ1xNup1zu118xpRMQJzeUWQyV+VD7AiEwb:nekTCz9C8WweWMruJZupxu1WxpdJzerg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 0e2572c9da868607bb62f7cf179d02fe710f5ed091adad01372da025d4b5d9b2
MD5 918d74b621303d8eab2df2a278a3a91a
SHA1 02aa12c63697da159f6c0adba04973aa94d0e133
SHA512 513267575ce8aa243c0d54fcbbe242a838dc3c0bfbf13be13ad672e7cf81062fae2bc8b2556201ae78428387e7f20d31f11324bdbe3483e087c23ab0cc5c38bd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 325a07c7ba8f76275c61b999cf220893f36a99bc45b2354d4b6a88a5b3e5335a
MD5 4688a7f6c9da6391ff5969580b2245fb
SHA1 babf376bdcb6538deb4fb34bbda69232eb2c42d2
SHA512 ceb2075452fc47cbad5d5b3c22d8462b41188374ec2575a337fe895c5cc850c851538c4a688954a9c087ec7dd8000247ae346d1365c944c72816186fe459f500
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 6f9c7fd17478801a79fd46e5dbb0e0ce43807ac1645a4a89ae0b6811d0d4c1de
MD5 0d8e1255e288f31f17f4f1fd3f1a61b5
SHA1 b24044037312d650be2ea51c9fc17e0b09d730d0
SHA512 e11fee787aa9dbfdc65eb86d4455132576fb4e72ad40f9d54ad6324a7555a046d0d7595551570158c122cf7c53d5ae95c12dbe4d0c95dff81f6332b65fd722c0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 4883f59f406923af2398f6f6478edb3b7e66bf73577523a86e491aa29de2563d
MD5 f73f79e015cb8b36673ef4ee478ad4bc
SHA1 1ff19e2add1d9ed0230d1d89642db559870c2fd9
SHA512 e03a2bb631444ce2b80a58b129f02322f20d15eed09cde487e768b075971475c409a7e4be0df3ec0c091c908521a5c91e6738fd29023aca99e77b2ed9b1d35e9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 90568ad29a51cb32af20ded1b4c991d335f3b42a8e18cd1355d5b0203fcd630e
MD5 2410b764f0c80ef27d35b52f30866648
SHA1 a70d28d64eb4494afd019dc21cf6a2c83e7fa474
SHA512 24c67b3e97efc35c2b8695d33b5a065d5e51c86cc8365ca3a6229db9c815ed0588324f6ce9f908b77d399e7477bf7b4f899c98a014180bbb67c3388359f7bb3a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57926c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57926c.TMP
Size 707B
SHA256 0606986310e3eb4c2905210908e4393e0363c65fcc57c3d4cacc124cb6b49d38
MD5 55a0291cc1016286a9576413754c4a94
SHA1 863a950b54bdee5dbd3b2b65f431faa0202f1ee0
SHA512 4c90fdbe9bd03ea3b17e75804b2446aa7196b0fbfdf611b4cc1d6b3dcef793c97b16b289f8ccd4db9923fdd4138df6d10477b834e55c483bf4d0ed23154c388c
MD5 SHA1 SHA512

Submit Download

a5a536e3-2e23-4630-b4b1-06f7fcc5b912.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5a536e3-2e23-4630-b4b1-06f7fcc5b912.tmp
Size 5KB
SHA256 cd36b66ffa057dfde9fe4d0753022df19a4e75a7740e25ebc16ad644718bfe3d
MD5 edf4bb84f8f11307ad4f523035a7024a
SHA1 82f732e93a7dcc648539db27b7158f2bba27b280
SHA512 8dafa59031c8bfc31c677fc5cd92713b9c76706a36f4f626372dc5b192b1202bee6cc40a7bff48574f0808847549ea8ba7406a7cdddf92aebe0f4102ccef6df9
SSDEEP 96:nekHX1dOD9wpvWMoiVmdeHpRQQJz+UWQyV+VDCziEwb:nek3CD9GWMXpFJz+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3fe851825d6132eaa897c413557a660eb9486b3d4878acfe2140f5d2552da5e2
MD5 ff8b80be74db41ba0b3475185d23c1fb
SHA1 94e072425f4cdbd631a7bff072e4edc216698baf
SHA512 a03766e7bdb894fe7010312b828c1bbc57a627506be317d7b567d1b3d61fe9211192c4c87648b44ff0189c8934a4b9e6ebd32318acd33914eb12a6cdae81367d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupk7e2RUQwTF+OblfBhDaavs:A9iIxuERzA83h09RZxYkr8F/XDafEB5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3c316af9751b0352d689c0c5d44009b8415aff8538e138337aabf44238c3a1b8
MD5 efc04e0d534b685e1a2fdac138c96538
SHA1 034976bbaeee22e7dfbf232f2cd5ba79506386f7
SHA512 c958a435642db1b3f8835f3d98e6977330751aa6f9f08cce02aa6dc66706ce7644490511ced9609476dad71d6a4526fc933d4dcc70ffc1cd7f4fcb6e2e73bb88
SSDEEP 192:VoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupB4Je2RUwqTa:Z9iIxuERzA83h09RZxYBsIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

fe1e07fd-aa14-4a88-b16b-a5f85719178f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe1e07fd-aa14-4a88-b16b-a5f85719178f.tmp
Size 8KB
SHA256 d3097056d6f4f6c5f7d2109e1209d0436c2be9e29c690d9e4b0179c3265c4450
MD5 b447598aa49393ccc861d97e6b50b661
SHA1 e91730530ca252104f66a4e898154ad532768d2c
SHA512 0b37e07c55c7a14bec780b19b4da3a7c9f2823f48aabe23543a79a7a5771483d4cd6d8209560745a5e662f12437ae3dada3384438e3d5c4671cabeead76543dc
SSDEEP 192:VoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBfe2RU9qTN:Z9iIxuERzA83h09RZxYBnbN
MD5 SHA1 SHA512 SSDEEP

Submit Download