b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
19/05/2024, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
Size

894KB
MD5

b23386f85eb6c9bb7645ff3c913c018e
SHA1

3fcf5e2980972e9b19e0138575a1b607eab54927
SHA256

b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c
SHA512

b8f4bc5d84dd3235e9221dc3f7dd7264a8a5fc004c6e460ae1e3009e369c2483a954a2205512b679f53e2f9074ce85cea757bc97993b8e082193de7010e9f3cf
SSDEEP

12288:+qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaMTB:+qDEvCTbMWu7rQYlBQcBiT6rprG8acB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1068	msedge.exe
1068	msedge.exe
3916	msedge.exe
3916	msedge.exe
1760	msedge.exe
1760	msedge.exe
3496	identity_helper.exe
3496	identity_helper.exe
1332	msedge.exe
1332	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3916	1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe	80
PID 1724 wrote to memory of 3916	1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe	80
PID 3916 wrote to memory of 2320	3916	msedge.exe	83
PID 3916 wrote to memory of 2320	3916	msedge.exe	83
PID 1724 wrote to memory of 2080	1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe	84
PID 1724 wrote to memory of 2080	1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe	84
PID 2080 wrote to memory of 3748	2080	msedge.exe	85
PID 2080 wrote to memory of 3748	2080	msedge.exe	85
PID 1724 wrote to memory of 796	1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe	86
PID 1724 wrote to memory of 796	1724	b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe	86
PID 796 wrote to memory of 968	796	msedge.exe	87
PID 796 wrote to memory of 968	796	msedge.exe	87
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 3368	3916	msedge.exe	88
PID 3916 wrote to memory of 1068	3916	msedge.exe	89
PID 3916 wrote to memory of 1068	3916	msedge.exe	89
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90
PID 2080 wrote to memory of 3016	2080	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe
"C:\Users\Admin\AppData\Local\Temp\b3b383a4345622758a2551ed9cd4dd950f7008c1d818e01b3a1b739db11a6b3c.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa7e073cb8,0x7ffa7e073cc8,0x7ffa7e073cd8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
    3⤵
    PID:328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,3092274550996811824,1937394146158609999,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1328 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa7e073cb8,0x7ffa7e073cc8,0x7ffa7e073cd8
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,6452209925465977916,11028803790059148258,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,6452209925465977916,11028803790059148258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e073cb8,0x7ffa7e073cc8,0x7ffa7e073cd8
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,16967209111579963325,13447074752115455268,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,16967209111579963325,13447074752115455268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e580359695787cd4137718d30396c24d

SHA1
fb91da9f3e48b6b00c57b178c714d654a66c703b

SHA256
0d7e8dcd52e0f1dc264cd6d1e768022dbda743eaeb51959d104a3c14af728530

SHA512
3c9ea18c6fb6862f6fb5e0d6ddaaae9d2bb7649ba7c172d2a8b9007e4baee6d14dbb46c327f1850234e34f39ab0fd7c0a497f73096e0cd71a76ccfb6573d24a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4fd56cefee45abd9a7ed47057a7fb8b0

SHA1
a9e75834ab01c326e41b854f3b964ba101125974

SHA256
b09c70d65c764ff68fc11d5f7e1760a6cea5062285cee19dc992a86b57237a8d

SHA512
c3c41dcfcfd72f83517fbdc4dc613eb491ad30fb16da12bcaf7ffe4268751eff40abb722c11adb3464af77cbee996761c2855e39ee328b6db65a91da0872a10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
76532f5a218957eab4293a85384b74cc

SHA1
eae58e579ceaaf5943474636bf5b5aaeef9a22cb

SHA256
f2e322310a2881c2a48082f1887e93bf404e5bbb23de7f2b38bfb022c79f153c

SHA512
adae2645cfcf6d6000fecb9c19734d886f79af83ea65f8aa65b4f34aff856876ddacf4a70bb69dad0e8d90d140b6b298ba39d9ce2b417f32e4598688b955c7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e0f47bc6b5d16880f56491973614ac2

SHA1
f30f5f1eea81dbad7e8bb3f5cba61e57f402aae4

SHA256
a2a507a4fdda1af7850e9c081ddf353b7aecc868116cb60f57184d8138b36844

SHA512
4988885c8554a8c7c6a7a3819aeae71ffd54a2124c6adf5217b7b258137a0573cd95bc07de05035b0f4ab5cbaa20f6ed45f41e8d63613924d8baa1df16d6d312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7d1e5137a63bba5dd4c494b0c2f63d91

SHA1
4cd9519af766541ca6c94da77c49923183636408

SHA256
9a8a44616befc60fab308e2c6e09391281b2ac09f1596d19ef3bfc0fe38b34d8

SHA512
bbdeae3779e62ba5bdda9519cfb5d7edb4292630ed0eb704f5cc6129148e4d5540063c68c216f034cf19ab80f8b27ad8357e4b64bb0a9cd5dad9df7b8e1d8527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
ba8756245b06eaa5f704f2f557ad2900

SHA1
e8521fe610c3da6ebccb8836ad136736150401ce

SHA256
721804a8eca1680e527e11f35a4774c7c97a153a0aa14866547027248cb6f3f6

SHA512
828615523e7d03af9886eac5217a3c631711569efe135bb8eeca850ab41f309416e31b3b2c38f52a7a2f939ff780a0e40704eb3d4dbf1153a2bf461ca6456fff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e1c8a485d7dd23cf4b6aa70ab40fc76c

SHA1
082f039499ba3264fa583ed5cf897ec4f3c44a2e

SHA256
0afa2bd354ca5ecfb792342c9a31cc42eab76d85375c9d54c2b388dd2979f7f3

SHA512
7cdeeb32da2df0badd1e2b4283ed61b4cd82526fa59ef2559e690815cbc3b39895c8cacff27dde6e52fe86ed58c95bf7a919e4cc42b05a29f00c4d58060b869a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
aeeeea871ec720be2c057e3661754b0c

SHA1
3ae78ed8eb2c697f0c7fd691504a32aa55e63f0f

SHA256
bf83ad91fe4b54cda2247fb05594ecceabde43c0f597aad666d4e49a274dc051

SHA512
531b4487838a849453a7591922e9a9fe65ee1e3d5376780f5c926a89b78d0d27a71fcf873b0039b50f1e8fc14455f93000c150b7084239c92f4d38942c6e5f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
9d4423db2af05dee4ec482413ad8e946

SHA1
ab14b8f0fb3787fd5649fb069a3b7aac664c4f15

SHA256
8e8609ca355add234ae5e5ec1a2d3699b872a5c18161abdd84efbc11871f88e3

SHA512
375798965405bb07da84610c4ccb931ff1bb70bd6b63636279bb3848a595b214561640b4a6f612896e6e73b1f964a46c23dee0ee7cd5f625a354dcdf0e013c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b565.TMP

Filesize
703B

MD5
118e94559cd087bb1aa9cf1842aa87a7

SHA1
a60ecba6941fe4ab8caa85f205f18b56176a739c

SHA256
5e781b67638af310073e5cf623361df8d3e3f6019fc340a32ca331f59888b8af

SHA512
6f3eac70bbc2368aa83f4a5d619bc9e85c056cbeb5b215aea677a036cabbdaf9439cd13249cce2c880a08383c53ba07f1d3ad819e14e2a48a054da3b46f8be60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
0a0138bd9041c087922da3889a254ad3

SHA1
3c9c5e2c73e4bc5724b4081d2ddfc59324d2eae2

SHA256
f9572ca8d72d32bfd925b56f07e783d81887676419385b58933e142c2d6b779e

SHA512
e22f6cccb374a5240967d6d2332b818783c978b6b3273a9e75d3c5fa2196315b9bacafabe7c81611708c5e7e0be6205913bcd05b9fa4ac73468ade217d645d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
7aa6727c7c1a4d43f2e22065cf828b7c

SHA1
a30e2996145b2cd7b7aa5ad968e88636b0fbebd9

SHA256
43b4cdf8eda3e919666a7b6ac44268a1ac5de7362ed90769b0f163ffb6c0e9f9

SHA512
8b991dafbd9110ea0ae661300365d5202a9d7ce67c91d8c1a439c300889efb82f532eb65ded9ede565eb8b360310582aa31d1333e47cf0796191a321c53ed57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3286b8578838381133c3185b83da1748

SHA1
588f9b1f69f6e45b1ac13e5a6ec8a91c5347f3b4

SHA256
5a9b09c3ab99260af65d85dec29ec51bb8e75087d1cbe5606515c3fa39e07f77

SHA512
d438100f6bb7bcf655d6f86503923c63a399b9aa768557eae7823d8757202a220b6c56a82297a8f0c954a212dfbd8be12f9172622b6f68d7c18b646de81db57d

Download Submit