651c220c441664a46a5c9739c329797fb8879f39b4bd7c862d56e0c4fd239a75

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Lazyware-WorkInk-Installer_741942.exe
Size

16.7MB
MD5

6d8f5c4665148856a97378be9379c59f
SHA1

f773e933488bdc103678de32be77396a2ec897a9
SHA256

651c220c441664a46a5c9739c329797fb8879f39b4bd7c862d56e0c4fd239a75
SHA512

d8720fafb86cf17f30635c042dd3f786135aa374c05e49a5f770cc4c7d68f98c0c61465071a51ab60ecb7ca8fc43de5fb0ff427363f80de9cc536af7c9099971
SSDEEP

393216:LS5G463coqG9cYzrEMehHirI6QtUUTC/fd/rFDgOCY:uGMojcY0JhHis6uUUMfdzFfz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5044	Lazyware-WorkInk-Installer_741942.exe
5044	Lazyware-WorkInk-Installer_741942.exe
2308	msedge.exe
2308	msedge.exe
1912	msedge.exe
1912	msedge.exe
4448	identity_helper.exe
4448	identity_helper.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	Lazyware-WorkInk-Installer_741942.exe
Token: 33	2852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2852	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5044	Lazyware-WorkInk-Installer_741942.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2984	1912	msedge.exe	90
PID 1912 wrote to memory of 2984	1912	msedge.exe	90
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 4560	1912	msedge.exe	91
PID 1912 wrote to memory of 2308	1912	msedge.exe	92
PID 1912 wrote to memory of 2308	1912	msedge.exe	92
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93
PID 1912 wrote to memory of 3708	1912	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\Lazyware-WorkInk-Installer_741942.exe
"C:\Users\Admin\AppData\Local\Temp\Lazyware-WorkInk-Installer_741942.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7ccd46f8,0x7ffc7ccd4708,0x7ffc7ccd4718
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6580145776621415887,6461967541338612684,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x418
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5846af5f-00c6-4fb8-8339-c4a4130648db.tmp

Filesize
10KB

MD5
5e9779ac2df306a0e924698e32a01b27

SHA1
7d12ec74932f865e3ec82b2235b155ffa9affeb8

SHA256
7eb2d50a6dd3b6b23a3f77008b8b974fd9f023d4418d2d04439faa9a0d7a13df

SHA512
2afc6ee89a2d909ed2eba5568c3e865cb5e0a5149535f110adedc8566d0e41fae1df8ea7c0bcede3ef8b815c5b1d35a4fbe437d1f5a6ce30cfad482a47929761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
48cba432b1a56e3c46704ded32ddabf1

SHA1
1909d75c34cc903f04c2acd3029ce3b74c1abfcf

SHA256
d19352d7a00af77c01288050e93669ddb83e94464260b0f16c400facc59e4e0c

SHA512
aa9c26e9bc8605f0c0599ceb6ce462ae30b2e359fb95ef7224bcdf0bddb744bd3353680956edfc7e2c8f30b706e1c3578cd992bf84aec473234815bd6e9a1adb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
1024KB

MD5
4b49775ce8a7364cdcda0840f44ba586

SHA1
3d1fb472a72bdd6500fb658b12c682be766de82a

SHA256
a2c630b93c91fedefbea80976320127f0c5309dc5d777e6c6928eeb20fbb899a

SHA512
2cb7bae46fce8ac6d56ad9bae7271abf0becdfac83c5e8af6918aeb973e3613a376eaf6b2d1272acc74895b95001628f8f9af05ac9d4baaac912fc824e7eeb8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
9ae726a044676330c573892a1b6c9c93

SHA1
45d905fc9125611e187558313ff503a7c747906b

SHA256
1774535efeaca59f1a847c6e5d00f5334b1e0975dee532df00e815ae9f26d730

SHA512
eb17855d1a920fd5d6c3d79474ba4a8b4ecc2c84cf903a9c4f28f4ddba873327376251aa7a40648f2a46676b8d3944b5654c71a5cf1e65d26f3b17f2b094c446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
715B

MD5
6aa01d6d03d6439cd7b7c7f9e2f73e45

SHA1
32b46164f448ebc59abc02fe25830dfda17caa33

SHA256
3ecbfdc846c58b334546d81d9f9a0e3fb3ff683e59d0a269ab5977b233304e71

SHA512
3a0f36088cae371cccc6c3c6589562fb5fc6e7359ac11161d22de40f01cd8a4aad98c7e870578ac74be34a86d4d0b0f7300977303c561742b8c7686fb38c5a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c13e89682d7dd38be4904d942dbede8e

SHA1
8ebff166c32cd272e7d2030cedd3b69b5d072513

SHA256
3d892e7fabb5453b09be3b2092a896f830fb57a56f57f1c6f17571401aceb3e7

SHA512
98fcf93abd3a7494a317874c93554483596a69b75dc7542494180fd3c1eac180b6fccc0dbc2e8c0559bf55b13e2682b81ba2b546c3d62a20c169ce610a28ece8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd4d10eb30e4086b037c78edc0d65235

SHA1
3f2d9fd9db68795a6457d39064ef9cae7d4ed4d6

SHA256
07ec0ae5b3fc84a8cb2dda832dd585cf753a81bf95b1eb5d1170b52216aa7256

SHA512
7753c5ef7c79e9887f54eaa94936cb9b2a1d072993a2f436e6dc7006fa3fb674c407bc7ad2eaec795b030645c7bcccd210bac51c41a993cd1f680cdd31e9ada5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05e0b5d70e21f2339d7da72133ab4234

SHA1
0a0125472fb4326dfe147bbde0a667bdd9b7c357

SHA256
618649cf0ae1b7a376d5773313efcb5dba09eac5da1034d7c6563321cdb44876

SHA512
76ee3a77bc6e6e3981babe07d8ec748065cfbb8d20ec2a6735e09c099144705604df7875ee9c88a1f6572c1acc5e40d9875f02902b4a30969cf24e6e0ac0e0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
8e403964100181fc5477314f0dda1f50

SHA1
934e2db0799194c5300be5ea6d55863f958c5203

SHA256
77f89c3b20a7921d2485365c177aab7b56cd2efa4cf014e59d1e903f489abb3f

SHA512
1d200aa0d57a13ff15c19f530f7809834d874535d996492862102f4e9a6e1f07d89aab0194102d47170178c623955d341254dfbbda2b1120f61b81420f52e3f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d774.TMP

Filesize
537B

MD5
fae3abf54a5517a5c60bedcec0b3ac75

SHA1
fd2d165720dd9df009673f89601f27fe1be6808f

SHA256
3bbf386dac9fbe6b88ab9cd93c666cadcb8f17520492997d839f4d6df0af7c76

SHA512
22a24496c9f0eb193eca16defbe64b6b521a1a564675543003385b2bd8222af99b9fd542dc54864b47650b4885f6fad9d7e9938cd02cd64e725a963d9c0acaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit