58bf2215b395dcac74c009aa98701854e43cbe54a1cd3a95fee6a647ca9910d4

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21/05/2024, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SSO.html
Size

118B
MD5

bad2e8579dcdb79399aac2064216a37d
SHA1

7771e4d9c60e02ce2246b5d71bb23f92b9fb8a90
SHA256

58bf2215b395dcac74c009aa98701854e43cbe54a1cd3a95fee6a647ca9910d4
SHA512

f6d2918f1e5fad175da8b6869687f770e6ea188566096600389bbeb4a1ec03d6f2fe4106bbf25d120118eff676ededc6aecc79277074f3ac92b38281e76846e2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3062789476-783164490-2318012559-1000\{2BE12AFE-3792-4E65-9452-07F9F90593AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4144	msedge.exe
4144	msedge.exe
1492	msedge.exe
1492	msedge.exe
5012	identity_helper.exe
5012	identity_helper.exe
4520	msedge.exe
4520	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2320	4144	msedge.exe	79
PID 4144 wrote to memory of 2320	4144	msedge.exe	79
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 3464	4144	msedge.exe	80
PID 4144 wrote to memory of 4068	4144	msedge.exe	81
PID 4144 wrote to memory of 4068	4144	msedge.exe	81
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82
PID 4144 wrote to memory of 960	4144	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\SSO.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc50583cb8,0x7ffc50583cc8,0x7ffc50583cd8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6504 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2638760791430372740,1811682215833042851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de47c3995ae35661b0c60c1f1d30f0ab

SHA1
6634569b803dc681dc068de3a3794053fa68c0ca

SHA256
4d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7

SHA512
852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
704d4cabea796e63d81497ab24b05379

SHA1
b4d01216a6985559bd4b6d193ed1ec0f93b15ff8

SHA256
3db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26

SHA512
0f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
36KB

MD5
29275fefce2934df742efb191686aa38

SHA1
a0480736da9dea050409dd49396303c6db12cd26

SHA256
3535e041511aa95b037d0680b00e0d7cd309cbe8af0ce1dc093b0301020f1841

SHA512
b3a969ac8cca8f128de3a0e0075a0f4a863b96d56bdbe4f3737311db7e82bc6048ac7969158e9a50acc3685bf6e5eddcc3b45bde99ad375a76a96e4dda4e4c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
d2d55f8057f8b03c94a81f3839b348b9

SHA1
37c399584539734ff679e3c66309498c8b2dd4d9

SHA256
6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c

SHA512
7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
40KB

MD5
e3194d50cb1d9e1b1ad60c84f49460db

SHA1
a53dbbd0fb9005e83a915aed35699b2de1f7d1bd

SHA256
e885b73c5815f01055b7fd325b670b992ddbf993189f81dbf375992a473a85a1

SHA512
435e60331bd918292b168c9b999b52f777838a6c49bdb0f2f41f9aa75687eb6e580c229880a4f98ae57c5ac940b51638ed99466c141bce253d04af8d739d3754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
153d9573f0f824b040ac13793d95e406

SHA1
f8a73c205962012c4fa5b93ccbc77d7b1be3b5d8

SHA256
c70c12b65715e837682baf0eea8ff99a7531d9036b0b5a9d640def85df92d016

SHA512
5e0f64f8d333be4fff5b869952fe18f3189d6af97bfce10aad8acae96153b790108351083f1b80c40d76cebdca35e5d7e0f3371c588a02c74e6ea0055a3d2b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
33KB

MD5
3cd0f2f60ab620c7be0c2c3dbf2cda97

SHA1
47fad82bfa9a32d578c0c84aed2840c55bd27bfb

SHA256
29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

SHA512
ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c1dfaef9f5c823c331c31b4799b7633f

SHA1
702ff959c7afd115957728422db23112fd2caf07

SHA256
84a7022dff4bcabf88a6fc2c11e3ec8fdcbb7ec46327fec11dbd87b30cd8a2c1

SHA512
f352d09b3e469d5bc46ca7b05de8b2b63965ffd8bc98e297913f2e0a8aba0150c23b83a6c5efb18c70e5c67ff2b3f260781d62aeff708928746d82f1b01b161d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
85b232594a98bceb6f96c4ab750d179f

SHA1
fd01542e66ebac6e3ed686bbeefaae124d89d2de

SHA256
03020e8305030c616f0c96bd1853b17cd964cd56aed86c0288dbb87ed5789e33

SHA512
19c19a2682d24d400ff1018adf60f40bf694c5d74892a12ead7f38d2a5f9dc9ea915f9135e6af9f2364ecda4576db8b2c67e2bc4163af87c4bae75ab16fde0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
549B

MD5
5ff9558839bd92b03e3d2920a432df9d

SHA1
18406712ff6d1dd580dc4ff93dc0bafe8fd60644

SHA256
635f007a1c547fe0d244a2f868a8f47323dee840d89a02a38f52d0a23b209ce3

SHA512
1848db9dc70c82c903ce7590ae8ca87bae8df64eb7387779ef2ed696f330a38ca271678451316701cdac02af9515fd58ed4b2c9af6be03da15af9f635e15b30d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
75d8f87156f2950082bec47b63d0433b

SHA1
1dbfafbb77a9cf390c5901baaaa1fdd5796aeccf

SHA256
3fdd5dde72ddaa7b4133df27485ae7c3759e814d416d91111604924498dc0104

SHA512
14731ea8555024922f4381ad5682bf84cdb534f8a651482942e1ad2d8aa69e56512f2036200590b19be0e2913d814b4d81a1c5b46508db5237dfce42588c0fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a06f79166dbff241b2b215a3ead5238

SHA1
09cc8b15a7de0fd5b77c803a2dbd11d3cc2aff4f

SHA256
0e2afd903f7a091452e0bd8a86bc23e6c1ac0b48b19fb44f7c08ce562af358f8

SHA512
43734a84fd712ea6c3fbc24ef44be7b1efb7bafc96a571a86702a58b531daabad15abd9875d4d68e32036f42d55d271abcb0964abcaa2c5bfbda9b702ba23653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b2100a32c6beabae125ced6baa12143

SHA1
060b1961a2906cb251532c7ff061c53509ef8d5e

SHA256
3b13acd822a8e5a6995ccc3ab0763120731935c8c64c4689863dd77c321ad795

SHA512
984700c85824c8b0f65e700d28f449326453bf429222d548ad7a6a4a4993c37fe575b6a6e4ce0ad269e18eaf4a06ee4f66cf277291b17963ca2892dad6caa8da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
daad4ec600ccf15515d8fb8c9f478f87

SHA1
d673e74be1f9d2ca0319368ee26a0169ac8084f7

SHA256
9aa44be9e70ef311ab42026031dbf7f76fe700b09b11a522880e8dfe393d0fa1

SHA512
2dd4a4ce8826c43b80e79865c543c77d8f28a672da82c5623fa937197b0e8f2e86141f45786f1a5cf1c0260b3afc05377363a18c924746eb6526408899f4d971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35c4fdab10d70266cf02b2085d929243

SHA1
6dbfd8dcc5ddae37e8274c7a689291cc12e11c98

SHA256
1c4d34bfa86cbff002c6443f94660ebf5ace11cb4d1e729303ca09cf36baabc3

SHA512
7574fb53fb8e13620253408de11bd841a2bb7586820aa457af2dcaa55686f8e081e473d4bcb47acae7886fa4c7145cf8d251712a28a91cc4412f91a711e164b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e364e5b2a79dec4c20a12023c0075c7

SHA1
15d8ecdd8c845515a94bf2600ad7c7e3e89037ab

SHA256
42648243898936d74cde412bd8caea3b9d54b317eb6bb226c45400a17f79d126

SHA512
6a3920ad93ac4b11a3b00f3d2742f25824eac6c08b7c1cf61372b4eade066ff42ba91a3a1c1103b8487d4c49ad4cbc14eb7f948f342ae75d5e046d855dc5f40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
c0114e2b9b3eab2d7d5645e4354d51c2

SHA1
b2b1deb5b6a28022eaaf6449538c74cd5ac5dbd9

SHA256
ce71eadb5d9cd3ffec47bec6d70bac2bc2671036bddbf5f74a6de7ee843ab9ac

SHA512
74b6f59b9a09a5de9fad7465cb3a1c060b59e9c7a9b6d0a4d2db2541eec6b32bbcad3580d204c56e42738706f2692d6d7168c9a56462c3c1a3f719d3df67c603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ad9c76d5fdc8cedc0bc4a040cdf7d9d4

SHA1
538d71a1a6efc4f3f062eca2c680203db6ca04a4

SHA256
a44004d8de7afa29a2ac03650f650ffcb3567753f4378c36af88751e5bd4cf8b

SHA512
199295dc2104bcf45d3fabfae5780d404d30ddbf6d42c1e172cae4ae391f4c85b9315f77b460a8e3446c81097e8b5b9b273ca22ab38186506b6bb55b313f60ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cb29025b1c2365cb69632b2114eb519f

SHA1
4539440f92d502d6fb6d0b99d5a009ee1372383f

SHA256
44811f33ea0fac182e4ac4af61aa8011b1ed8a9ebdc2bc1abbf01812466c4446

SHA512
3fb2ff49c32dfc1d0c389d928e4179e4e20536de3eb35d872a5a603d94ecddea4268ef4967b9b59a93352e884b45614f17e2cdd61e2ff3cd61141617eb99d027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58848d.TMP

Filesize
538B

MD5
beb22144c121f11d255f55aa00a502b9

SHA1
569ad0b568e507852b8b0428b3e2dfdb1ec4076f

SHA256
0e83d194aba0c83054f878ad2b4137aa13d94533b380ad346974dba437007ee4

SHA512
c9fd77378db60d40dad81a155c1ea9ecf5671f72dc4b0202661aa66ef030d1d5147e7c4d1c0eeb7b78d704df9434337f852078ebe62ef4fa49c66aefe01948ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64663b17e2270b0306b6537ab060013a

SHA1
3ce8b60f4f8798c9c2b01618e4d46ab0ccde7827

SHA256
5422e75a8402d4fcda21a862b3c6608ee256a6845af4065ba710f4a0ae267812

SHA512
ea8596c320650e1614cf48f7230d09b216e2f23d2a2ab9b5fc7de9e99b5faedf8553e99bd8756f60f7cc3d5af610a265c7506d3d9c731d6e099b28b2923caf63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
75d21120f76b1e438a13add4cb5b541a

SHA1
040ff1b0ae30fe1a6cca26c4010cc16602f43b1c

SHA256
44658d5fd2e36237e2f82050f418f1ba5841827ca4cf3b306897d75b67aa8977

SHA512
3ea1b0ee41fd75fa64a45fc4e89982cc05790a5979255fc5ae14c0319548fd8082a47ea0b77dd29caef7af6df4e2543260c4236daf33a1e0e71186366d8a0c1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
e5b0565db9ac974e6c0408a34a828416

SHA1
116d1cbc45deca897710349b92c05e17bfe04b82

SHA256
05ab713e1c1476bfd1b94756fadf0b98702cef6b802f9b1030e45d4ab8de7999

SHA512
1ad2d3de4842df4e7e3f176fbcd5ceea90d0953a5df51347fc6451c9f8aaf496e3c5e2d22c6ee6b4411d4d150daff3df81cea87478e0096440608cde7f1eb2ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
65c111bd37af830ba5e987f14f10ca0c

SHA1
2bcfb45a223e85530ee978762b66d7f750f58811

SHA256
3ddfb4e41e7a29ff2f9a75da9d322255d3d9b27ffbd4353a399c94fa11787ad8

SHA512
60a292062c527330ef475ec236256184770f25559f2b5f38ba590654d3f710b494dffe6e522bba5ca2de189eb0578fe03e65318c12517e3c9e2b1bc7731cbfaf

Download Submit