258a142a0e0cbb673697eabf88315dd8bfdcab2856dea0db12430ac938fb94b9

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

258a142a0e0cbb673697eabf88315dd8bfdcab2856dea0db12430ac938fb94b9.xls
Size

111KB
MD5

1aebe4c509eb170bd5fbb5af3e53e1d6
SHA1

623c7967628952c7a86ead2cbf72f32ab7f2d3d2
SHA256

258a142a0e0cbb673697eabf88315dd8bfdcab2856dea0db12430ac938fb94b9
SHA512

e1ef59f9652aae3f6325515b86a88030ae595e3010244eb44a9b75c5c6b271bfbaefa761ecb674640eb3e85ad39901a3df1b336ce19f438c1a7abb7f1a9a36a8
SSDEEP

3072:90WF2Q0AVhYkbJIm46+nhLwFiLJU2vDR:90W8KVhYW/4/F9Lu2vt

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeEXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1340 EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1980	msedge.exe
1980	msedge.exe
3700	msedge.exe
3700	msedge.exe
332	msedge.exe
332	msedge.exe
6112	identity_helper.exe
6112	identity_helper.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

EXCEL.EXE

pid	process
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE
1340	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EXCEL.EXEmsedge.exemsedge.exe

description	pid	process	target process
PID 1340 wrote to memory of 688	1340	EXCEL.EXE	msedge.exe
PID 1340 wrote to memory of 688	1340	EXCEL.EXE	msedge.exe
PID 688 wrote to memory of 2424	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 2424	688	msedge.exe	msedge.exe
PID 1340 wrote to memory of 332	1340	EXCEL.EXE	msedge.exe
PID 1340 wrote to memory of 332	1340	EXCEL.EXE	msedge.exe
PID 332 wrote to memory of 4552	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 4552	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 332 wrote to memory of 3524	332	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe
PID 688 wrote to memory of 4100	688	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\258a142a0e0cbb673697eabf88315dd8bfdcab2856dea0db12430ac938fb94b9.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://isols.co/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17874893
2⤵
- Suspicious use of WriteProcessMemory
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe53e646f8,0x7ffe53e64708,0x7ffe53e64718
3⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10411188498480121483,3270979800364847334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
3⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,10411188498480121483,3270979800364847334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://isols.co/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17874893
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe53e646f8,0x7ffe53e64708,0x7ffe53e64718
3⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
3⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
3⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
3⤵
PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
3⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
3⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
3⤵
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
3⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
3⤵
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
3⤵
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
3⤵
PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
3⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
3⤵
PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
3⤵
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
3⤵
PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
3⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,9572531847536662536,9627736548568727277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2648 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
cb81d619cd68eb3da5546a8108e02f4c

SHA1
1e64429b7905bfdc049dc8bcff822d19b050956c

SHA256
15099aa210f62af43c9174b54631880ae54680d5c70a2b101307467f0bc1dd25

SHA512
12ac5bb4865158de87a8d48e5c9494973d835411a3e1e9e5e084275b2b9e4c057d297da3be964411eb1413604b7a9c7a72544dfd34d7d3a7a7bb93b18f9748a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
176B

MD5
d73f11a47cead40e325cccc9c11edee9

SHA1
79be7f4d3bbbe2a11307e8d5eea988c1f08f7687

SHA256
72a7f74891e1209cd3fe322441dcb150a17ed92e5c993699fa2bff72168d3c1d

SHA512
0e947f05f3bddd8a8c0a3f4922ffde01b67fb1656861ec447207c24a8e4e145483c4c8057bf3f3ad6bdba495afa693e43d2de499a01f49291fdf566cafe876b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
445baee288425236e9ac36267f03c25b

SHA1
118cebc22c76d27785264eec08d3bdaaf42b5df5

SHA256
38406fc2d0909119d66a21d2d7f8bc874bb45c970355c15e1117051439fe8c80

SHA512
90d2f3200a9deb4195b969978f06b4b647b686ed008711ddfa10347358f5282406e3be29904b08590043b67646099551b505703ab87baf7b4b6ce9dbba77de78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
454632846298cb93f4cc77161f012c15

SHA1
ebc2fac34abcaf6ac3e00ab6b491cf10af350b91

SHA256
10853d122ac4a123f2073425af528ad022ec581096d5164039bdf1f92526f126

SHA512
74127e5874f63cb2e26feb5ae944304d0d9b139c7fb9e72679d247edfd97a378e4096c80d108a1985c503af1c83c490c4e34be069ac1257ac8340070ac38a532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
39722bc3d15bca6b30aa7c2c68397dc9

SHA1
d7e3d2772aa551b8c3adc13fabf42fe5bc62fd85

SHA256
097a914bd9cd4c0ba7f9d22cbe00013596e0208ae87bee60247eef33f5c22855

SHA512
fdf9a505a1b702debf25d7ec70382057beb6a1cc3c4945592cb327c2840083ce65dad297dae111cf0f73dfe04155bddc1e8afc286c27f7ae6f30f4caaeb3e732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14bd4ee985027469e74403b4f505e0e4

SHA1
651900b1c0d41911e46587cf96547c852d84e361

SHA256
27ab759f84a22120ca6bb39da4066089d2fba80e414b6af4abd5f0ff7405ed7c

SHA512
36ad87b89b7bd354fba247c3e19819842daedd9414a7298d021609b10eefefdfbf8babb2710b86951f33cd92fded99e2d1630b30a07c92bbbd824e6393728c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
7cb66de32ad5e8a64564dc77ed9b904f

SHA1
831ae5d2cea060006090119c3b2f0faa8fae679e

SHA256
c6eb2b24a645a5e07b63f4fd69dbafed6f383dd4e73c1a9efbd8ed330a19fad3

SHA512
a461fc8787c0062a7d2cc8ed9d73d445abb6a875df8f90303b019deeedf585d0662a2252621abfc82ea34632f7801b931cccb75719409fb063a14d0726800e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
ab0d02ce386336ccd305e3ebe585ef50

SHA1
c6f18c2010bad96879c281397ed2b11e72754b1f

SHA256
4f4aa513ef47eae271829f98273b95197d1d07b8dd317b0549e60b72c63fc070

SHA512
f70945c870b68dc6a1c31a6eb48f58e3a9accdeaf3e897408435f2e020c892832c92ba43e3541c20284fcb26ffcd4893a8b7ad290fba113c102e2c7ef779efc5

Download Submit
\??\pipe\LOCAL\crashpad_332_AXIDBZQIGFRABFSX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1340-10-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-9-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-22-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-21-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-20-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-19-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-18-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-17-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-16-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-14-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-12-0x00007FFE3B470000-0x00007FFE3B480000-memory.dmp

Filesize
64KB

Download
memory/1340-13-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-11-0x00007FFE3B470000-0x00007FFE3B480000-memory.dmp

Filesize
64KB

Download
memory/1340-15-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-0-0x00007FFE3DDD0000-0x00007FFE3DDE0000-memory.dmp

Filesize
64KB

Download
memory/1340-8-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-7-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-6-0x00007FFE3DDD0000-0x00007FFE3DDE0000-memory.dmp

Filesize
64KB

Download
memory/1340-5-0x00007FFE3DDD0000-0x00007FFE3DDE0000-memory.dmp

Filesize
64KB

Download
memory/1340-4-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-3-0x00007FFE3DDD0000-0x00007FFE3DDE0000-memory.dmp

Filesize
64KB

Download
memory/1340-159-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-162-0x00007FFE7DDED000-0x00007FFE7DDEE000-memory.dmp

Filesize
4KB

Download
memory/1340-163-0x00007FFE7DD50000-0x00007FFE7DF45000-memory.dmp

Filesize
2.0MB

Download
memory/1340-2-0x00007FFE3DDD0000-0x00007FFE3DDE0000-memory.dmp

Filesize
64KB

Download
memory/1340-1-0x00007FFE7DDED000-0x00007FFE7DDEE000-memory.dmp

Filesize
4KB

Download