hxxp://tetr[.]io

Resubmissions

17/05/2024, 09:58

240517-lzgw7scf7y 6

17/05/2024, 09:55

240517-lx32nacf2w 1

Analysis

max time kernel
115s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
17/05/2024, 09:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://tetr.io

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
2184	msedge.exe
2184	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
3496	msedge.exe
3496	msedge.exe
5448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1100	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe
2184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3568	2184	msedge.exe	78
PID 2184 wrote to memory of 3568	2184	msedge.exe	78
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 2920	2184	msedge.exe	79
PID 2184 wrote to memory of 4576	2184	msedge.exe	80
PID 2184 wrote to memory of 4576	2184	msedge.exe	80
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81
PID 2184 wrote to memory of 1144	2184	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tetr.io
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9b7ef3cb8,0x7ff9b7ef3cc8,0x7ff9b7ef3cd8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.CdmService --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=cdm --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.CdmService --field-trial-handle=1904,17799068491411948597,15977468067374551846,131072 --lang=en-US --service-sandbox-type=cdm --mojo-platform-channel-handle=8140 /prefetch:8
  2⤵
  PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
046d49efac191159051a8b2dea884f79

SHA1
d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

SHA256
00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

SHA512
46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d22039bc7833a3a27231b8eb834f70

SHA1
79c4290a2894b0e973d3c4b297fad74ef45607bb

SHA256
402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

SHA512
c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
17KB

MD5
bf8986d1ff0fdd025f5f6004e562ac9c

SHA1
62bd3a8d631b3dea09ccff1cd8312509cb75ec93

SHA256
6df73a092de3b6c328ebba69481eb00383e63e6f2b24d888fafb60233a485784

SHA512
89d11b638860336beaf52100712945691d0a0897a31c96d5f51a0a1e0f311d154a127d9702bdc647b6da3e9e76c92f439b40319cf0c00f2d074d6cd720839ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
03d846efb29f5d6bff9068545e121ed1

SHA1
a7d2c0b9f33e50386d322af3e2dafeb621d3e445

SHA256
70235d882197705636170e44999d9a30e154a58458aade89fdc7ccdc84f288a6

SHA512
a582165482d585eff4040c11740b363f344f67d1571058308bb6ea245f58d22799c5f0d4187625031e55e8c9d5908c1c4d7eaf19745216d79f499916ed9586f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
3c074800520bc264557c820072ab83ed

SHA1
ad6047674d2f80c4190c0e010d3888956a8e1eb7

SHA256
fac86c7a3dbda0d03c046727cc9b587f3601f02d4457dab86070b0ebc30d3d34

SHA512
eafca8ddeda9093d60be32d4d287fdbc016ec96748233c1f5f7adb8f4b3cd3226d50913766c35841d1e088d0412bd1f51ad585f3e34ae22f00549774f91c09b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
2fa308697faf0d6adb1db698f6a1d9ba

SHA1
8d400c6ed0a7a1e33b0273bdd9696909fefc7ec1

SHA256
a510f029a45e6cf4768520dd6678410eb8deefbddebd49c6d3713ea2fd543b30

SHA512
67b70faedfecdfefaa4a0a41d69990ec4f0286ca982c3b23699e534c8429e8928c1bffd15fc3616854a2fcc9e2ee5e6ddd6237c5b2e6e96cafe86b8c398d5acf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ab6fde000e84fc66d7a5bcb861e9fe5

SHA1
dd6ff4d78afdc4690e24975088b376fa5febb2a8

SHA256
cd1cb8a5b05ae73597c4559c64ea2b319b4d010e10d063b0848fb120cfc5c96c

SHA512
9f44c280baa707e988ae74c5347152a003457473dc2f942966b9e22ff0f8faef3f67e6119774bf760067d9a2ca21cfad5dbe6c03c0d8b32af96f8ee2cad55da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
fcc39f1c919e7d62049f5ed82ba85030

SHA1
a8b31b362141dfe824a5e52704a310666827d148

SHA256
9fb15785c4e71f879dbacc0969fcb5d921a79ae141fdd1a13ffe74c0613ed52d

SHA512
c4d574a9abc75583dda4d278f4ca256943aa14272b3357460b6505d08c8a430e707c3e79dfba4e2680472ef343b72ffd27e0ec0a5fffc43845fe6befcf13c682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b01dddd27aaf8ede5e58868d62cc46f1

SHA1
f699f7bd28bd657bc1863a6ed8fdc10487409070

SHA256
459a37de20e94e06a30bc1f34feb00d9edf32ab6602a5233c382ff0a0998215f

SHA512
17ef1b383735e3a1f57e01397c1852f319b65349b8f526e0f9ca32581b134ff1507585597929bc3e03f0c8af7653db19ad6d907ff44ce29c600e0f5bb2b75d4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c0ed5907f92521eadec457ad8aa65d28

SHA1
94e0bf81f40142e97489d2b5afb13ab04814f7c5

SHA256
0fd2a30f7033ddc1bc45bcc7ddab24b60d90c66b01d8160f3777d5c8c870ce2a

SHA512
f7c52b193d357aa8a6c489b7fbec82361f4da711e14f24ee233995f86185c8ba35d6046a98bac123a4ed1ca5753555238ddff7062244a54fc77a20c02afaf454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8cc0435202e1f80b6d3289724ff252ed

SHA1
8d568aa9fcb80abca42844d390973104770a0488

SHA256
c7a542e8123cc6350ecf24adff260cd1f6f0eb4c6ab19048bee014bba8e7903d

SHA512
bd5503682d0434daddac31bd78ac5d1572aedd7619543b22624499b36776c194eb43b97c4f12d71662a43a68eee3f399e6408bcff6dcf844d667a6f5bd7efcc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c8cd4683adb15e9f785d32e23ef8d4ba

SHA1
4923687c34d34a65b27d657ef2c8d5ff316b187a

SHA256
180d0155d4da35d92d16fd46b2caf84f71b3c4106866829663c0dd28ef35f207

SHA512
93d1bf0b018682a28279ed1ccc2a63d618ba01e5defd9d8a36d53bb04b361d805a1c55f71727f232426ed2e1d3463c20b7253df1e863bac74a9073d0c5fe1e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
0ae060d36e3c6cc217beaaa6549aa298

SHA1
c86a44b1e7c21fba00e3e1fc7569f8132e2e3109

SHA256
353c453e355f6e450883ab30ef57977b2860c4cf267c900a48c8d863bb494c00

SHA512
aa7f671086534ea30ebce44df3c508fc185f2d044e864018b1320d7ca4012247c59f8ccb489bacab7adc471c1dd681bf89f9bde8993080c327f02b8c4bd51996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3a8ce9a0e4e8fd1a797003119b4d5266

SHA1
98826e81aa9da2d580d8e10544995f4d1feee222

SHA256
21a09e603ce28c096cdfd30c618aa8151a233142b0eb07e0320cc564ecff18c5

SHA512
7dcc6799ead6bd5475475fb39ce4bbf548b80b06313cc1f69ceb11d6beb598c76c9e770d1b4d17ad132b685da74c85cb92bc633425e4defd4512871a10f4f904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d23d2f0faf08875728292580a22d8708

SHA1
9231d66b78f364c7db8a543c61c687a4cec4f0be

SHA256
ffa1600545211667c90f04a77adeb5f8c01791b67028e9f81f8335586c60b590

SHA512
dcbb2948c62090fc9ca6268db8e6b5f8d4a864152511204f18645195d2bae5fb5c502ffec77118a0f764c45c0531522af729a1dcbc9b10f12d44b8ffcb99715f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
95aefc2bcb4fdb11a80d5a0a768b192e

SHA1
08238b28fcc6e09be6ffeeae352ea6bf8f5d3c0a

SHA256
dfc7df0a2f9cca1cc17a5473170c8991f5d5023b3b45c53a7eeccf4aae9bcbaa

SHA512
8b4833b01d2ce9427a946b3aaaa02670fdb94852874178df2c973ca810ae1f617697066c315c50b366d0c96c4df56bf75bde9fe75ba12054677bfd10e3b4b502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
cf6be222c3c3c638e5bf5ee3956163d1

SHA1
9b9fd91094cc9ed9b8ce2a9198a0116cabefef29

SHA256
2b59ad35de71e9fd59226794908ebe31e2323a58678f8978083e5722ec549639

SHA512
b2a92a1cc3ef079c70b0fd954240e48a8e291f2d74999b7ea56e5c000b98f1fdfddfa7ad79b7e161f36aa86747e1f48f417b75c1755d77637443adf64dbd1534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8d1d7128c114835ee39522f570deed9e

SHA1
3b2bdda87b92b5eb981f02267d6576e69f73757e

SHA256
d26cc4ade77d64862b85e36b22740bb4de80a4c52452c651ae0d05052906b2b2

SHA512
8cef841a198cfe5a4ff7e788cdbe165b5aab75414a48115d5270948640dbfee892e0ffa76afad9edf0743f069a6ff79909aba866caf8375d63e297c7cf3610bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cf37.TMP

Filesize
705B

MD5
32df43bae1ce36fa571b7a6c8b52c39a

SHA1
5ba6b23b6a12db833f299a566f7c7a032d129226

SHA256
55082c21d2127a1ddcc21d7003fb0f0b9fc4f25dab9f2bf31463430de3445d64

SHA512
d60bd5524148ea6450537c8d050fa0a32388e6747c916e67ecf643bb7f92cd0e20073f9d729b98240d9004d6b4afc69f4c30811240bf6a5987542a08dad716e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
51fa6e5066e83345b2a3fc100e0ada41

SHA1
3d5a70fc9fd6fc1e1d832e8e1372d22883f56824

SHA256
5681f6e284a61ef6457afb59789b38e8edb6bf1703e60ae9992d40ddd0f45059

SHA512
c4e85b142b11181d9e23a9939c1d8770cc250e0662a8ff1d6caf6a26090ec6b9c87ab6d844e4517a8eeaaff6579b8f31e36d623eb016f3d255ba1ea1a29c48e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d89f49f172dea69917610ba99ad67839

SHA1
1cb00abb486ecc47787ef020e9c06e87f99fce1f

SHA256
55ab0587d6d93f182c621e0f764c4f8be90f60fecdb63d46b7b26f931c10a4c4

SHA512
0356278190adb5d28d9a88754fcdddc30940c7565764061fc5a8a88c13fbb7abb180fc28e17ac254d4edeec877ac4913c8ec82739e6676421bff823334477bf9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit