hxxp://wearedevs[.]net

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://wearedevs.net

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1232	winrar-x64-701b1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3906287020-2915474608-1755617787-1000\{12019E5D-A14D-4FB6-96D4-F6A525509574}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 477691.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
3448	msedge.exe
3448	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe
5320	msedge.exe
5320	msedge.exe
1840	msedge.exe
1840	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe
5192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1232	winrar-x64-701b1.exe
1232	winrar-x64-701b1.exe
1232	winrar-x64-701b1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 5612	3448	msedge.exe	82
PID 3448 wrote to memory of 5612	3448	msedge.exe	82
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 940	3448	msedge.exe	83
PID 3448 wrote to memory of 4520	3448	msedge.exe	84
PID 3448 wrote to memory of 4520	3448	msedge.exe	84
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85
PID 3448 wrote to memory of 388	3448	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wearedevs.net
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab54046f8,0x7ffab5404708,0x7ffab5404718
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Users\Admin\Downloads\winrar-x64-701b1.exe
  "C:\Users\Admin\Downloads\winrar-x64-701b1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2336,1606776841609809149,17480810341302026724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
803f5ea92497cf33fe618e277d3d1d14

SHA1
d4c5880f1f61df5cbbaeb2f875aef5737cc9ea0a

SHA256
87d7dbc3ea48d15c203a205329c02400c13fe4aecf297705cdc241145321e5a3

SHA512
75db7c33fe7770f74e32ce14d0e400ea50ccf16c32a8f42e34456b80811221c22988e0a397f675f5164c097a7b3c890aed010380a985a509483b18f144ad7932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
db9dc42dd3af39406ab3a08e80d68559

SHA1
abc5d677b88dbb631109a105b7e5cf764478ec90

SHA256
d797404cfd338addba03a4a504f45f04858b341c28f134050d32ce3100e35283

SHA512
fde80801d34f3079ae1a35db6aa5bff93c40fd1db19aa19c7ebcb85b6854dfa28caeb55c4fab5d56288d98c81d8e31f1f2634fe183133d84cf4d65b932d0ceb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
26a89fc54c8c02b094aebbb5ea34dcad

SHA1
279a63e9ec74ef9a85cb5281b37a05426f365825

SHA256
a5d46981d056aaabf01ab6a4406881f4e25e437128bb60916c60cbfbab02d61d

SHA512
7534d13c5832c4e075ca849a1eb0f29fae75174ad54a0a5c1e88c82d9c9f5d1757c3d0b9a0b219de949b8f16798414bd25ba27c24c701a7e4a32a2a5f7e4cd3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
057ef5eeb3876858c9d50aa07efa5f86

SHA1
c1d3691a3a119aca2fdc130cd545b2f514d186b9

SHA256
b4c45188fba6029ceee5fd64ddfb270e1fc7b99d56bd3d1337d8907c24cf1a67

SHA512
a494d09eccd33e1906976ccb75658c0f3c64f1694ef445315928fbb3bff80e0abe7f08033c15fb210713066d902053c07318d4440da51ff0990ce11425e6436d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9c75cbc0198d171ff8b4bcfedc4ddcd

SHA1
29be6ad5996918863ceb34136f471c0b66ce3fda

SHA256
4b6f9fdb36ec224fe4b499f593654fbe437aadb8dbc20534f45f8b3764357f0d

SHA512
5e7206635df05ac029d0e4d189c7b6469822d3a1c8d05fe241d24d0eeffee16ae902b2c3c8e395818485d7d64713b2f3e3c3ad6070dc7bfa35676751fdd87200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
705ea08691ca2916a6081ff503c049ba

SHA1
b697fa0c81a03e7db5a1eaa314247188ed4a174b

SHA256
fe149a5399d30bf84e4d179c5f0a1bfb0a187c516c702a9c3220b16c016a3fa2

SHA512
b44893339e8ba6a66aa118d1fdfd2482a867744b50aec91b7c7fa19359f87c6a158af6091409b8c0d6395b5f113b3db75865ae2bf40bee2b09fc21742eb784f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a81277bde0b497093db147f1973ec881

SHA1
c79836978da81323c2360528b06ade2cb0fa77b3

SHA256
50fb6a489477ac0cd985f2d150f9940e3e12b8fbc1d1abbb96991ac1c8490018

SHA512
17f4720cc7299bfc0d9d192762fd56eaace43590ea5cce2fe8a60f68a801f3b449caa7843d890568e831043be392580a2fb21781a084ee3939d63e5fd4746272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d8d51c558e84864fcf6a41b905fb9465

SHA1
84eec93e3cfb7fb6f9ee70c74b64d8b9fa7fe316

SHA256
5693534ad539777576356e0f7fb35338eab8ad4e01dd06533e75d1ba39a8683e

SHA512
758432ae14f340154ddb91c1cca3426aa9b940eaabe459cc8aa679131c5858877a414f26d6d578b6d20fd10e0e8033d06e28ad6833bb4df5db6e4a3fcded75f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a66413f4ec479ad31c0d5905f1281007

SHA1
345b5b77845265b48f71657afa3960d8969324e2

SHA256
f51e351367e0f378ef2cf723caee8a33c33549aea902f5e6713e53ecad95a288

SHA512
561756d5329cbe9097f267eaf6d270b07289ba9f3b769a914017ee8f2c4f5e9c21ac0c5c04c2851c9a2e2b61542c41e98a1a911e2d4c24ea6cc52f0e8b0ad956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a9be6b4224b17f43b3e134f1da958269

SHA1
41d9713e943809f05672f1f814887f949658c98e

SHA256
471e23b04f34151b8930268ce1a5ab4b20d4f1912d49fb05c321dd23da31ee01

SHA512
0212aa118ac9dfbc97913b95f6112ad201b257ec2d242240b928d594e422769d9206f2f268665ed9adb079639e0210c668e2fef069a481b8c7dea6b6585c6a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f859a94788c51c06215b56aab02d80a1

SHA1
4169ca468695dfdc03d19b42aac438e6087e8407

SHA256
a0924309f54d2ca14582f876d2298995aef249e3725a7cf5ba47623352d31b93

SHA512
a19424b599da2c18f8c1da0a628a5fd9baf315f3d71fd753a9e0485e53f4abecd67a1abfc5f80b93ad4c8a7410a5e60dca01bc2c16f08e073af37761e5fa8890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
38af23cf310cd2e97a618a8c59ed0ca3

SHA1
7e3ebdd1fc85aa6f3c4e42111395933751c69f78

SHA256
4828ab8484bc559fa3c16a76d016f8cd7689cadef826fc291aae1403e3eb24ea

SHA512
3eada215b168a34822e4ff8454df7b16bfe0bfea6c24b342a5c1c8b89af5f78beee97a9f1c62453d3a953339093c9a6d89b858be23cdd97df9e1f4e0d3dbe8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579402.TMP

Filesize
48B

MD5
b47d7731caff345f99a3b3050a1308d8

SHA1
9fc842468a5e86eb05e8428df5cd03a4843c837b

SHA256
68177d13f2e50465b7d4167d4f9f20316b246d58905839f05e079f9329a72453

SHA512
c7a307d6127d61d2aaaaa9fe2421b04a5f049d7af3937aef2c37bcfc53c72908574e245a14e573f1d63834c8fec7682bcf15f7c1f05ccf6cb69bca7a95d03a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f3c1982fdd8e7bcad8848d39776ce04b

SHA1
a307bda0a1cf67a1192e744e9a8bbeb60d91774a

SHA256
587c4a4e668e7cdf8b640b3827a44c56188fddd1560ec60fdc6806bf23fb1884

SHA512
93d4b20721241c91e634d0842a11942e17dfe788fd8a92ce94a8c2cb09430b7fab9db0b3675f60a82c69010876a571780e56b4dd1e69e8597c02042e0e660a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aa6b0f33658a8fe2413b2609043b8798

SHA1
5d5032dbd602aa56357d96292145c0a93a5cb657

SHA256
119fb783d87bd6cf54ca33444b68d2a8c481703406f315ed7c6216376cbfd7ed

SHA512
e7813d9b225aaab7a769164b0b16c62a4f9a09fce7e7e2b94938b65ba8c5a5e9325e537041c3dbe8296861b1574b539145fd03e186f4682471e377b49f013d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
195e20f9e6b10c71d8e74cc3e4909e08

SHA1
1da58e384eb5e0cca9d24e645485d19002d5e23c

SHA256
a5ffb6d3d13c64c38e3ffd0c87be9eecb0e31f948879c6295a10c1fc9f289ae1

SHA512
ef3690c509f3cb687beb3ba226d425214edb2faf6cc26f11ad35fcf3d6d45586d14b58f5d2520125dbbaa51919d5c31f6c493c2ec48de0faba4fcdf54cc14695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9d4ce0906d4598ecc4bc9b983f576006

SHA1
7f9df127b00b88c8f3961940f761c87f3dab5c95

SHA256
c69c1c84e967e6efd34c4f57c692df0a9b33bdf85dc3200fda8774362d88fb57

SHA512
7b2b7b98f643a1c9e4d6d3f912e5809e4e397d533d3593eb8944d361d695b2c614755235ab9cc928d7383d806ad6f0eadc09a27a8b019d3eeee50ece3d6dd235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579e34.TMP

Filesize
1KB

MD5
056826e3f4ca052f373825ca4ef8d3e1

SHA1
a00d3437e10731a6f128c0aa2a0f5b128a1dcbd1

SHA256
e6f9e45bb2f133a89f28855e031471e2c8c95fee420594edc1755433ef3a0d6d

SHA512
247e55a0fa0664049c4ef2472176779d3ad05be6d4fd21857db210ba6bcd7df17df772c876dd0870c14b6cd783c0040a5a2cb0a3942a55afbdeec492e613a2d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ebc08dadfca12f477af65e338f929ada

SHA1
de7d1692497dd0a322cf77bdc2b4ff37265e9202

SHA256
78641158988e477d9034f8e669c3c1180157e9bd566b44079eb7c3344d78240d

SHA512
1d5f1641b24dcafa9003a859863cf4f2bc6691eab59de17f92102a714d0328c63572b2f3d9d9dbde26a4d54d2aaf111d00735f27780d87148968ecfd52c4032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2ebf6f1ac4250ce10e6eb9ba8f00df82

SHA1
61280332fc8793efa653939c74f3ab9e78c1904a

SHA256
a41e01f15fcb6f960368cab82945ba4e78bc363fb31b720b6062a52e24047c0f

SHA512
ed952477a4aa0db20890c072d240ab54eccf0faff45c46a49c423576c111c15c015e5fc209f8f57a96c33269a191bb737a3a2712d1d7167df297deb87caa266d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
98b906f7f8deedd60a11ea4b3803ba70

SHA1
7c8b86979e1c98fd52244986e7ff689ead85e0c6

SHA256
042df283ce3b31117646cd864c0026df87877940121099efdcea6180e7bd2fa9

SHA512
e9c918955b3241450f63a7f49c531273e16f3f11082b293c543d8c38dba6870c08a4da52ef9b6efcb15437b800e3c65f47816f75ed92425f4d3a1cbdf66ea4ba

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701b1.exe

Filesize
3.7MB

MD5
60718ebf4145c8d99cb686e6977b8ff7

SHA1
2b5cea0fb9cd4999bd1de751e8aff8325df69fe9

SHA256
aa60a7d12146469e2b52eae12d29af83639f251efb8811e70b79d7c6fbe7a13d

SHA512
1bb85f7a0a8646dc3af84a43063d7ea11633ac027e30f8d38dfa295c2327603ee1339fd43ec6e02dfeb85107b76f6419262772e75f0f3cf875a216c97f422469

Download Submit