hxxps://informacion[.]novedadonline[.]com/lsg/XZjc0N2Q2OWVkOWFmZDg4N0RuWm5pd1lsbkZla2kxa05NNzE2cDRHelhwbHR6WmY1Tzh0OUpsVnBBS3N3MHRDY1BiWXd6QTMyQkNFdzczeUdjeGZQeFFXWTFQU0hPUHpZZzdFMGpnT0RjMGtIL1ZBVThvLzA4eVdmbFMwPQ==

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://informacion.novedadonline.com/lsg/XZjc0N2Q2OWVkOWFmZDg4N0RuWm5pd1lsbkZla2kxa05NNzE2cDRHelhwbHR6WmY1Tzh0OUpsVnBBS3N3MHRDY1BiWXd6QTMyQkNFdzczeUdjeGZQeFFXWTFQU0hPUHpZZzdFMGpnT0RjMGtIL1ZBVThvLzA4eVdmbFMwPQ==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3571316656-3665257725-2415531812-1000\{6DAC10CA-EDF9-40F6-B25A-84DD6BF57EEF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
4744	msedge.exe
4744	msedge.exe
4244	identity_helper.exe
4244	identity_helper.exe
5216	msedge.exe
5216	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2428	4744	msedge.exe	83
PID 4744 wrote to memory of 2428	4744	msedge.exe	83
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3668	4744	msedge.exe	84
PID 4744 wrote to memory of 3288	4744	msedge.exe	85
PID 4744 wrote to memory of 3288	4744	msedge.exe	85
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86
PID 4744 wrote to memory of 4740	4744	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://informacion.novedadonline.com/lsg/XZjc0N2Q2OWVkOWFmZDg4N0RuWm5pd1lsbkZla2kxa05NNzE2cDRHelhwbHR6WmY1Tzh0OUpsVnBBS3N3MHRDY1BiWXd6QTMyQkNFdzczeUdjeGZQeFFXWTFQU0hPUHpZZzdFMGpnT0RjMGtIL1ZBVThvLzA4eVdmbFMwPQ==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdadfc46f8,0x7ffdadfc4708,0x7ffdadfc4718
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16067008531185026157,4108398865709802952,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cf28aa1a5cbfe7af737b9246aa88bc0d

SHA1
2f0b56b5e23a6733f1a09de5e394967430e5dd23

SHA256
448838d86312e500d83065f6c8bbafadf22727481d8cb5310cd31d839fd7b116

SHA512
6337878b896cb3a2983d114fb92301e5b88106cf65152fa806dca42b168c3d5969b9393650911fcbda459bf14ab540db6c922da4b38ba34adcad8a4238b19b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c2aacfdf43f6b0e4452414d91ea432d1

SHA1
89dac1ebc4eceeb2e6b6da9ef06c8460db27248f

SHA256
87dac6620243d2c3701cb134ea48a8ebff10ed5060557c668f914df7c3fd6d2f

SHA512
3a5e5977ab35581674faf1858e20b3b626bd36b249fd9a2dfb2c63ce970ee3bf96270cefe19ad386490040e618c4c6ceb51a158a52b99657a9ced3c7b519cc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
4288b19fab9444eb2cfa6696bb77918f

SHA1
034cd9aa1279f7d510ba1727e1ceddc7ce03786e

SHA256
f2f96c999c87c0463f7229f87a2e3ea294637e6d35cc874f85c0cac6361b28aa

SHA512
a8086974652c9deaafc90209bbe40eb78c3e5cbcd72138ad0afb0af99bd7a623c84fc48439307d8e957ff5ebc23a04b21fdd2d24cb3e077be3fb68d1f264fd5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
86d96fb4b58640d40021ec99ec9f2c24

SHA1
b39fb99e921522d0c8ef466ce5b7ac81bdf53d7a

SHA256
d9ac13e399e8c1f98cbfb002200796a1990b87180c83501a7d37fd0155f79fae

SHA512
bf418e9b77069336193c87e9c0f35e7d0592041d5c3f4c77f97cc9fd79b268734ce386069cae254152c6a253c43a78b57ca1fdef4662e9d937b0c27211c33071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
ba2b9a6415753ad3c2e8bb4aef2f8550

SHA1
a308fd178fecdab49fcb46e9e59fa318ad56b4ad

SHA256
ac5bfff0e919987277abb40fc2f481d3f65f7743e7899a9e162468bd0f89a2c3

SHA512
d4ea1438fb4b4350bd6d243fe2b8a0f407ad8d05fad1080d05149909f5071a1caf0fbdf99c349efc13f02cb1ca771de1bf097dbd6824cd621a3c2861a4903dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4fd8281e647983d1284390ade54be94e

SHA1
447695fa6934451ef094eb592e6d6b2a34a31ef5

SHA256
c989573ff8ba647473900b55003560c8f78256b99130d977fa157ed8f94f14b1

SHA512
da9f40da3300b593a5265ef082542fae5d3c51af9df3cb531d1f4f517241ee826749c2ef249a0ae2f5388f8157b41bc8c0f2d5d0558647b0aee7808296fa1ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
824ad4f3effeb6d7e75d4f313d19331f

SHA1
f809899d859cf9d289d6e0f90364d202b232354d

SHA256
4cbefc90d3ce34467f572ea75646adf53271b88b751b2cf690015e4ebdc486f4

SHA512
a8d0b50e4b4c263fd9ab7eefe5c19fdaa416b2d88049284d12cb01785ec1455d361da07676dc242084334d563787b5d9ced540b5fd2e5a4d6eeb95b34d2b06b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
c53b44e8fded8970fd304f30b17a30ee

SHA1
b864f860daf5b0809ccb71f01bcb35b00db1e22e

SHA256
53e424add7cd9625dd3fe824f5ae4ee6ef8aa5f8641a776eac2a6f38cde52ffd

SHA512
eb4dc2c521a7a7d9b00adba67a31c7776b4d4268fb7fedce516e38cbbab830d7138d0a349c5a2568c0fdeff15d9a56ff495de4d0b1385ebe92896e6716b743fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
97b77849568cdbd0ba86a06a663f4ed1

SHA1
cb91bd5d71cdf2c750309a53172e65fb3daeacff

SHA256
77661c1fec3e7ec843c58b47cfdc7967c6cd5437a7f16c76deeb8c1000d9725d

SHA512
7fab2d9815c98841175a681ff6422817122a3a4c8275dc62cd3f416646a640ce95e968dbfd8de380cc13703a793ee0b5430101c86f2b4f9f50117e8a1694c51a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
79a3ae4989d5d5490925c98b24a7e775

SHA1
f85676f81ce3e1b9d461cd7e1c09b1ad06ed2e4c

SHA256
a3dfcbcde6e444f8c44d35070f1b4ffc320f661c68cb584755948c02987d42d6

SHA512
a54c6004279328f29f5fbcd3a556699564feff5f183ee56423fea3ac2a1a241f0d802d064acc70e74d65e7cd10358cb08ed58b36ea4b9870dc07a09abccb04cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
4f351d55d7a7a7d6b5b37c344c702e09

SHA1
2cce95387165f4d30b81a5a35caa6d1ffd7bb35f

SHA256
ba34bd11576e3f83fc84e82ae9c22807880a696f3a697bc3d22e67b6de5c625f

SHA512
6da4db8555cde46aba275746c01fc5aceedb9c001bde31a38245e3fac8a4289c62d4111dfd3919cdaae17cd0789c0a701c2083dc778e205c0cb2264424f629eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\5994309ff53f737486c7bb2ff901984e299d8fac\93eb5509-bfba-4992-b84d-76f877d52394\index-dir\the-real-index

Filesize
120B

MD5
20728e1d4a4c2bf44cb3585c690fb9a9

SHA1
8264b149c1780cd8d75cb5c4224a0f93d33148ef

SHA256
3e0b129b93a43b43af95d5ac7eeb2cca5ea54401458da10fd977dae714da2aea

SHA512
ae76b140dbce52c846159e8cf3c2c12c07a2ee38dec0e8b002ac608f3fc0ad7c176bd1a3e3e29f08d93523120bf15319bcffe6a588774e934111e65705e7bc9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\5994309ff53f737486c7bb2ff901984e299d8fac\93eb5509-bfba-4992-b84d-76f877d52394\index-dir\the-real-index~RFe57ab82.TMP

Filesize
48B

MD5
07b542da896c22de1ba4a57d7380a27c

SHA1
137a9c551a136e199090fa94811cc8c3cbd275ff

SHA256
faf8be6d1cab52c9043ac53cacededa7db8f680b71d62e3d3e34e336d230d23b

SHA512
1e87581d93aabbccc282b08a2234a48df33f428215afe0c414a5486b821bc5cd860fd3daaca893add4f95fa2d8c8b79a254696e62a975dbe559caa4525b1c964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\5994309ff53f737486c7bb2ff901984e299d8fac\index.txt

Filesize
105B

MD5
8edd31a348d439288fab78216946a2a9

SHA1
07674d1bc69d15c5d0fde638bbfe7b699fae5800

SHA256
ad7afa7356d17fd72d1ac073e815b52938dcf1fd61340d046fde643b6ffa40c5

SHA512
58bd06f8da793cd2309fa600e2b3c85df68c27a896053650e77252f3f6a63630cce3482d1c9967a284abeca70363337f14938a1dc9edbf3b44623c0c32f43c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\5994309ff53f737486c7bb2ff901984e299d8fac\index.txt

Filesize
99B

MD5
be495c457ab2ec9d75dee9cf1ac2b0e5

SHA1
f7be13b9abf06e6a2525b3743f6788326763997f

SHA256
2077c33722a74971bdbbc814c2dfb5eff181eb240340b0bfc9ad10f9f86be592

SHA512
b671393da731d3b572ebcf49092288471bccff798b484432bc1d0b945664a572ef9109da2f9911fff6fcba3267fb61dbd65161074bf3ddcd86cf6e3b627bff78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5f8d97b31610c8c896c67f20dae3e1ba

SHA1
2a3bc1a38ef99cf07875f2199f464d96417a30cc

SHA256
5c993dfd489d06f48d21eab6ea564029541b8e60906eb5333ee5387b6d32c211

SHA512
7275c8ba992e387d14286cd9f8a572585633744ca59e22f0c92bfcbd83d3c8b68d42f8939e05a327d113ed220f66b23e341ca10c4223dd7cd5f19b05d6da8e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588e02.TMP

Filesize
48B

MD5
8d297d8b29c1d0f041821cba646048d4

SHA1
e23a4e5078b075d2d4091b6def6f7a34830179fc

SHA256
57a6b4f4cbe33d78c44600c5f64f5d71babd8d6f86849bb6ca2842895ad34290

SHA512
2422b27634083ab528f03ca6de7b5aaba1ae0cb014c2893e7998bac791ee60f73da40e9daa76201dbdc01cc7dbbc714670f52352bbc94afe20eee6f6f3396508

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e78c484c07aa2dcaf42749f2c9982074

SHA1
3d669685ef8307625494b2d22f13af36075ae892

SHA256
829a8ece800b31094b1e63cddb50e794e4806171737518cdf57a803aec728fe1

SHA512
ba6394d0232b1ef56c3691c24a05282322d9d208690f9a8c1440d28d68e8e1971a14f14645cc21181262cb923e6b4d794d86aeb25190d134f006e0a905694d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
39280896db6250d20bd2bb563f34fe9b

SHA1
8b67a48eb7d4b9efb2f84775e4d40c41ad991e59

SHA256
59091135b13c2759d063fac75d138570221672dd9054970531c1be2daff4b695

SHA512
6ffb70baba28182c638e9bbe637dedab10a4477e036473deaba5eace6bb98b96fa6fe02cd00a3419e55c69545109cec979fc8a95829f34ccc9aa428ec9d0823d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
53b4cbe1018da24ca6ee72779350c034

SHA1
68ed9b5af4917eb1796f8ba0b995ddd498a2e995

SHA256
f27ab056c7be413b8f103d5683b1af90e2fe62e5a12c51ba2e218eb756f265fe

SHA512
93153dca1147bde585f9abf846d2207419d25ff7c26c919707f452cd6d88872d2939e492c69cb2c4c7b2bf9721eab45df549f429f38654b8301c754bb662d8f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c488.TMP

Filesize
872B

MD5
e43425d2542ab22d893526fc72d19a09

SHA1
c8b9e8db2356586cca522c4ad272f0ca7fad2dad

SHA256
a1cfa6b9c3db5ae288b0444b4a60258d413bb010514e650e7fe9f4c71a5cea2f

SHA512
b68d77cac9c09c17872eefd678a22a8c4766549b67e4f5a00b6fdb22a9cbce492c1b298c8dc9333ebe41934087f3a6c44d5d4895039f82aa5345c38a4c06018d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a856a2a0c493625ffb623c215ea2d49d

SHA1
bc3182a0b5ecadd74be188789663ef3393ca89ff

SHA256
324d0db42dac480d91443b79025d16d00809e582e79e6b660defd18743a06011

SHA512
bd9b3e043357cebd1e0feca176cc1cab8fa53ad5b44a19c1a8ed8b4ade1a519e7e9e11d7b46e0b38f831b82c925fe488ea6c19dc71b75479686fe279f8dcdc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee4514d44e4e8bf58d2359187ab098f0

SHA1
2040048fc13e9395bda172769023efd96e9df282

SHA256
5f127aa5e690fb17615516e564a673c688aa70583c6a616e30b028ed237d3e67

SHA512
d023bdf6309edd12589d317b3a0bd56633cb83836c283ffce7a41eca16be6c90add89dd21c495dcd3008029f24c3189ac966dff301c81ad23f553696e8aac1e4

Download Submit