Analysis
-
max time kernel
1799s -
max time network
1693s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-de -
resource tags
arch:x64arch:x86image:win10v2004-20240508-delocale:de-deos:windows10-2004-x64systemwindows -
submitted
20-05-2024 12:36
Behavioral task
behavioral1
Sample
Beatware Internal v1.8.exe
Resource
win10v2004-20240508-de
General
-
Target
Beatware Internal v1.8.exe
-
Size
7.4MB
-
MD5
c3347bb80d40975abea0fb9392ff730c
-
SHA1
551f40a65f2380e93fc0e5e466c052486b69674b
-
SHA256
09056146a9fc630956948e30d8d9c58272a887fa0c4fc3e839cf21ab740f1a8e
-
SHA512
038d7f67729b9674ce59088450d6ee7d4904e7ca843c9cb737b7fb539b5a8c9e97a9456f83e694010eba6a842ccd63f688ac281806cc279832030fec63d0aac2
-
SSDEEP
98304:3vP93uKPFjSHD5Fy3+1ZILwKcATnBRHusa4m7BS3:3vP93uKdjSHtFLmwK1rB2
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1200-2-0x00007FF733FF0000-0x00007FF73496A000-memory.dmp vmprotect behavioral1/memory/1200-89-0x00007FF733FF0000-0x00007FF73496A000-memory.dmp vmprotect -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 90 discord.com 91 discord.com 92 discord.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606824180963924" msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{11E50891-4783-464A-988E-1388160DA030} msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1200 Beatware Internal v1.8.exe 1200 Beatware Internal v1.8.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 696 msedge.exe 696 msedge.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3052 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3052 taskmgr.exe Token: SeSystemProfilePrivilege 3052 taskmgr.exe Token: SeCreateGlobalPrivilege 3052 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1200 wrote to memory of 3052 1200 Beatware Internal v1.8.exe 94 PID 1200 wrote to memory of 3052 1200 Beatware Internal v1.8.exe 94 PID 1200 wrote to memory of 3532 1200 Beatware Internal v1.8.exe 95 PID 1200 wrote to memory of 3532 1200 Beatware Internal v1.8.exe 95 PID 3532 wrote to memory of 3748 3532 cmd.exe 96 PID 3532 wrote to memory of 3748 3532 cmd.exe 96 PID 3532 wrote to memory of 3736 3532 cmd.exe 97 PID 3532 wrote to memory of 3736 3532 cmd.exe 97 PID 3532 wrote to memory of 5044 3532 cmd.exe 98 PID 3532 wrote to memory of 5044 3532 cmd.exe 98 PID 1200 wrote to memory of 4808 1200 Beatware Internal v1.8.exe 100 PID 1200 wrote to memory of 4808 1200 Beatware Internal v1.8.exe 100 PID 1200 wrote to memory of 2248 1200 Beatware Internal v1.8.exe 101 PID 1200 wrote to memory of 2248 1200 Beatware Internal v1.8.exe 101 PID 1200 wrote to memory of 3632 1200 Beatware Internal v1.8.exe 102 PID 1200 wrote to memory of 3632 1200 Beatware Internal v1.8.exe 102 PID 1200 wrote to memory of 4484 1200 Beatware Internal v1.8.exe 110 PID 1200 wrote to memory of 4484 1200 Beatware Internal v1.8.exe 110 PID 696 wrote to memory of 5064 696 msedge.exe 114 PID 696 wrote to memory of 5064 696 msedge.exe 114 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115 PID 696 wrote to memory of 4936 696 msedge.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\Beatware Internal v1.8.exe"C:\Users\Admin\AppData\Local\Temp\Beatware Internal v1.8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Beatware Internal v1.8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Beatware Internal v1.8.exe" MD53⤵PID:3748
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:3736
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:5044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://beatware.xyz/discord2⤵PID:2248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C color b && title Error && echo LockMemAccess() failed, don't tamper with the program. && timeout /t 52⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3724,i,7797594065369972631,4543692813189188696,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:11⤵PID:640
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3920,i,7797594065369972631,4543692813189188696,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:11⤵PID:4216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4076,i,7797594065369972631,4543692813189188696,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:11⤵PID:2096
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5424,i,7797594065369972631,4543692813189188696,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:81⤵PID:3668
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5304,i,7797594065369972631,4543692813189188696,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:81⤵PID:4276
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5848,i,7797594065369972631,4543692813189188696,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:11⤵PID:316
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5868,i,7797594065369972631,4543692813189188696,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:11⤵PID:4552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9df30ceb8,0x7ff9df30cec4,0x7ff9df30ced02⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2936,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:22⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1896,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:32⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4180,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4180,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=120,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:82⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=552,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:82⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4444,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:82⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4436,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:82⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4016,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:82⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3972,i,12797346222558300463,7524386905862955645,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:82⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:116
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
1KB
MD5f6b517a8b73e46e1a7dc8e6c8ee96ee9
SHA1e16338bb97425900fa68855a52b3412ef6c71f17
SHA2569937b365862edc38512b2e04fe5a7cdc9c26273b119dbe311ea1d9f0792514ef
SHA5128bf13ed79669ba1a611a74cc9824e09257ad888be9dc1e7d62d33f688319ab6ce0687a97a1d3996c8ecbe8c8457661cef5c2ddc316ce571c36058d4c179564f4
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
11KB
MD59a94c7e5c8d506f5f5ef4ab4943ad12f
SHA16e670ce434d2b191c02eba5bdb3501f1f7103ecb
SHA256b506e0aee6bfbc7041400ecd14b64603d4c854069f3cb2dfdc1e9e09e8d1784d
SHA512335645a2300400a81c4c1af6345cf79f1bd87f70d90774ca3e0bffedf71ea7961d5485714e72d6f592b413d472f3f0a13d08188ec3e5b2f4aa2658b654cf2cdd
-
Filesize
30KB
MD53d41de522a63c1d60f0422d86c5ef15a
SHA1650134e9bd1ff326f225701eb289acbaf0ddb512
SHA256f91f10548c17b58ba2e6d79c5b8c39d2f546e82528e6e3141c8233644ffac822
SHA512d2d64da0460ed2942249c86c52bdc971aabdb07be0ce961b0cc3d5c4b5857d89320e0f1dbdb1d3e73eec6e0e62d944a398e06816983c6ec7b004f37f3df454d4
-
Filesize
52KB
MD5f3adef18f535f0a3c52384841f07987e
SHA1aae99fa1856adcc544e56ba52d9f8242c640b421
SHA256ace16cbb50a997ebc6b13f674692cfd8ac6ca08f08959479e8837f611a0c153a
SHA5128c7a535489c581840ca95858d8998ecc8371b8e485fee2b0859647719e7a1783e5e90923882558df294526ef5dab6ed76073a14d3841f6fb78b2855fa35ef756
-
Filesize
63KB
MD5c9552b7b05eb3e45d0d90e65dd28f486
SHA167c183d2ec05c39ef1b994d394ffefdc7efd55c9
SHA256846c01e2e522d4391080f99842b67c5bed0fc49d8c93acb21a39f3f51fc58447
SHA512c3d616b0701a104a68c08898913dd90342f35f32dbdca07a9c6609d94a602390e1c4a7e28d62e6f2cdf03c0765f0d284d3bb86e3f955612bf6bd2b3895b64ba5