f9938f7f69b631e0b5b36bbd32a21e16d563ae80bbe39a0d01eeab7571fbdb4e

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55637c9a7e74aa40f6b0903808ac2dd5.exe
Size 894KB
Sample240519-glv5fsdd4s
SHA256 f9938f7f69b631e0b5b36bbd32a21e16d563ae80bbe39a0d01eeab7571fbdb4e
MD5 55637c9a7e74aa40f6b0903808ac2dd5
SHA1 bea9f81e0c8d66a38588ec5c9b1418b16930d407
SHA512 4a30dbea8b1cce9027632194b1856150e7c4a1276a48620bb621608a88bfb857e615ad11dacd9f01415bda128cdb97f05398386c25f5b65d8b6e126bc542ab0c
SSDEEP 12288:rqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TH:rqDEvCTbMWu7rQYlBQcBiT6rprG8aAH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
5100	msedge.exe
5100	msedge.exe
4780	msedge.exe
4780	msedge.exe
2008	msedge.exe
2008	msedge.exe
3356	identity_helper.exe
3356	identity_helper.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
624	55637c9a7e74aa40f6b0903808ac2dd5.exe
624	55637c9a7e74aa40f6b0903808ac2dd5.exe
624	55637c9a7e74aa40f6b0903808ac2dd5.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
624	55637c9a7e74aa40f6b0903808ac2dd5.exe
624	55637c9a7e74aa40f6b0903808ac2dd5.exe
624	55637c9a7e74aa40f6b0903808ac2dd5.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 5100	624	55637c9a7e74aa40f6b0903808ac2dd5.exe	83
PID 624 wrote to memory of 5100	624	55637c9a7e74aa40f6b0903808ac2dd5.exe	83
PID 5100 wrote to memory of 672	5100	msedge.exe	85
PID 5100 wrote to memory of 672	5100	msedge.exe	85
PID 624 wrote to memory of 4488	624	55637c9a7e74aa40f6b0903808ac2dd5.exe	86
PID 624 wrote to memory of 4488	624	55637c9a7e74aa40f6b0903808ac2dd5.exe	86
PID 4488 wrote to memory of 4900	4488	msedge.exe	87
PID 4488 wrote to memory of 4900	4488	msedge.exe	87
PID 624 wrote to memory of 1492	624	55637c9a7e74aa40f6b0903808ac2dd5.exe	88
PID 624 wrote to memory of 1492	624	55637c9a7e74aa40f6b0903808ac2dd5.exe	88
PID 1492 wrote to memory of 1624	1492	msedge.exe	89
PID 1492 wrote to memory of 1624	1492	msedge.exe	89
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3212	5100	msedge.exe	90
PID 5100 wrote to memory of 3004	5100	msedge.exe	91
PID 5100 wrote to memory of 3004	5100	msedge.exe	91
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92
PID 5100 wrote to memory of 2420	5100	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\55637c9a7e74aa40f6b0903808ac2dd5.exe
"C:\Users\Admin\AppData\Local\Temp\55637c9a7e74aa40f6b0903808ac2dd5.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffc0b8a46f8,0x7ffc0b8a4708,0x7ffc0b8a4718
    3⤵
    PID:672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16804439728197686626,13438790307436745426,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5456 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b8a46f8,0x7ffc0b8a4708,0x7ffc0b8a4718
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1500,5180794769621998457,3849319653303847507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b8a46f8,0x7ffc0b8a4708,0x7ffc0b8a4718
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13016607616738029350,13839412253271758560,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13016607616738029350,13839412253271758560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 12bcf7880da045a2709e8f8dd23688b5f66c4800edb533add734ce3e4f480cfb
MD5 8fc0eed615c9bcd93f104fdabb73098a
SHA1 d64a129c36a787e8e12b72c8dee7dcf36da45b3d
SHA512 383b6e44011910b48c0864ad2e276dc59def597c36bda5fb34093d118df116bf13be95c5c721b85a56b894f58b76abe8373a4d3bdcb403ee686719d98e740185
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b70100be9498d0335750d302b96a917fd9845f06c991843957efff61eefa0758
MD5 84ce6c86b8dd1b82c96b0d55176ab864
SHA1 817729be1b2ed66140887526cc08398e27016e00
SHA512 8e1494c47d4521a67fbfb4bea8f4a3f77b57ed49486802924a76fc770d1a4699db64e13eff6f91e13b01a279cd4f8c1f0265665becce25ddc8b1567b9f0a9071
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 90106dab5e19d58e1113fbe4be467e17c998ac32d1b9a0ad5b7898a0011e8ff8
MD5 47cbf6e20a106b0c6bfac746feba1557
SHA1 8544e5111ce64b8c433117d6724809cdf4cc044b
SHA512 01ee08d88a9651c4395b05fc3e69d241c1651123681fe7122054d545f0c5b8f1a67a9a780a56ceee5ba222abfbcbdcdd9f803a4029dcce0497d6e88b7932fed8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f186a9779ca7457d62f4967c6e74e9988ee27a96829d310b335045e69cfdd8e1
MD5 710f2178fb0a6a5cce592f20bfe99f40
SHA1 382f119a3de50146c6760c0d51ccd04bbf68864b
SHA512 e7f243fa083034fc1f62076942ee5a7ded5b2798187d4ea8a984cd51094969481845ec1dc536ac38228479c4f4e7b40db682cbccbc8df331204076f606505f7d
SSDEEP 96:nbekPrk1d8juwpvWMoiVmdeHvSSMxuUWQyV+VDCziEwb:nKko/8juGWMXDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9a49fa3ee00f168a2a7750779bc2b5e7552a22fa3cb36390f5c4dd4e47b76de2
MD5 08bc652ea6fd7c445eac5f6ad5371a8b
SHA1 7c22501fda5464a753981be2e82585a4579fdd3f
SHA512 158e13336b8a5d65ce0ebbe7c1b70974c93f21e1442b757c7e3aa7a1e5bdf1c95f6ef2d1303a4c465a9f50e48bff4bd7c8cddeb9636651e11034ca90bae366a7
SSDEEP 96:nbekDrk1dUjuwpxINosHBo2WMoiVmde27unC1xoRunY1+Nunc1VGsxvSEgMxGLZU:nKk8/Ujur1htWMCuCuuYWuclxCrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 0cae691780e999a1a771dfcc69e0caf2ffc8a8f574355226545531e2b1f7f161
MD5 8002bfc618cf4bb29691327e5afeb584
SHA1 cb1f6b0fceb28090cd5b9353625f99b6007fae60
SHA512 c32581717c6edfab9cd39aeffe75fdc31b9789ff386e08e4993759f7ab03cbcea71033329ccec06bab690ededa7acaa3a0b7f2978d09182448e435784cb1c0d2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 dd2aff89556aa068f5e50dad307db380466d14ed37a06554090512c8b05afe45
MD5 540c292e1c65caeb7abd0267da1f9cfa
SHA1 1b594bd67df0d862236f3c9aec8a6d33ce2c458b
SHA512 cbe532ae9cdec520a8475518b29c299bb678857b8bac836719587b4357161b108e3d1afb712e0f66c95ffe20931db455244ef4b0e48ef92db98cb991a5a8dce2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 703B
SHA256 f7e25270a90de5ff48806ddc44c99508729db04f4755b1bf0de5666fa4e46683
MD5 3b8481d576ce739f966484e1183b8b98
SHA1 01ddaadba84e78c1782e288d87d0edf2c6192306
SHA512 51052de46150fa3ae6529e037924a58e379acd3395346ac8e9b187e67ce45cc18adae02249bfc22594e82964c28f937b667c03b074cfe3be744756bfac523ea4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 703B
SHA256 e27d14bd77c80d6ed485378d3a8d6df911fa6a35d43119823ffde09135a80b15
MD5 5f0c304f5b1e3edab696cae936aa1493
SHA1 d071506949a1f674bd8ac3c4ed06e577ee91e5e0
SHA512 ac065b2923798f4bbaf161b9499afdea545c0183ac13668e955d1dd9674e340855d45d8fe2067e2c6078947602c3f79d12f05f4bd575f18e60137092fea8dc05
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b14e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b14e.TMP
Size 703B
SHA256 a3edc99d4369804569ad86891c85a0ff9b33d7b46c7641ecba7544816ed20d7d
MD5 f507f3da3a480df30051742f83eef20d
SHA1 a091d1ffc3e6a629490a9c0ef71b34329c5b1a28
SHA512 cd5348ad3916e6e164a8f4e961340a922d343dbc47a44ec85d78cfa349f5075421f3aed8f6f9af900eeaf0b6d64ec7bfc1d440288290dabee2b3a497766778a0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 668a5a623d320d805a6cb6cf23c054c4657e7ba958cdd76304787731627b709c
MD5 ec0a08864010cdd25f7257a7267fb0a8
SHA1 76c8d91b7debecc7b54783c9f11a508f3470f779
SHA512 5a494ce7ee5ed1c2db626a42f855528890f2cd39abeb26bdd066d40f4f120d543c2e62adcfa3807713fed27d655f930065d84c0869ca2d6162d9dd6475b245d4
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupise2RU/Rul:M9iIxuERzA83h09RZxYiyLl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5507d972923330d1513ae024f27b86bfb1f24127f1a517d81d2cd28e32715ba
MD5 abe05ac8bd6515559832a3e28f5a38f0
SHA1 db569933ab55f3deb49fb16e0c58aa2d1e5b7148
SHA512 2bad70fc10ee0164f55b979c078e564c1aa63ed1d17b15c077a62a37b90dfa5de1bd093fdae8375b8bacbe9e03c93f56783035bd722585c392a6ba8a81dfae77
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiAe2RUtRuN:M9iIxuERzA83h09RZxYieZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3bad6238f919ab47f8e20411d4fc9a29a6a898b6873af0f364a913b5312682ed
MD5 da9018dc231aa2270f3704d1beee6fa4
SHA1 67257c520b3e14485277755089525951b4e48012
SHA512 800dff1a4039ef1631f3db41bd7149ed907c7aa351120f967586578937009993e8bd04767581bf36f62643a3114274f63c180046ad62141502da47cb15d24dfa
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbve2RUptqu4+OblfBhDaaC:A9iIxuERzA83h09RZxYbXMH4/XDafEBC
MD5 SHA1 SHA512 SSDEEP

Submit Download