hxxps://www[.]lookoutnotifications[.]com/1/?utm_source=TW&utm_campaign=2854360d

Resubmissions

28/05/2024, 18:09

240528-wrsc3see4v 4

28/05/2024, 18:08

240528-wq4pqaff53 1

28/05/2024, 18:04

240528-wntrqsfe48 1

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.lookoutnotifications.com/1/?utm_source=TW&utm_campaign=2854360d

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4400	POWERPNT.EXE
2772	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
2180	msedge.exe
2180	msedge.exe
2548	identity_helper.exe
2548	identity_helper.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5292	taskmgr.exe
Token: SeSystemProfilePrivilege	5292	taskmgr.exe
Token: SeCreateGlobalPrivilege	5292	taskmgr.exe
Token: 33	5292	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5292	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe
5292	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4400	POWERPNT.EXE
4400	POWERPNT.EXE
4400	POWERPNT.EXE
4400	POWERPNT.EXE
4400	POWERPNT.EXE
2772	POWERPNT.EXE
2772	POWERPNT.EXE
2772	POWERPNT.EXE
2772	POWERPNT.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1740	2180	msedge.exe	82
PID 2180 wrote to memory of 1740	2180	msedge.exe	82
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 4640	2180	msedge.exe	83
PID 2180 wrote to memory of 536	2180	msedge.exe	84
PID 2180 wrote to memory of 536	2180	msedge.exe	84
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85
PID 2180 wrote to memory of 3136	2180	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.lookoutnotifications.com/1/?utm_source=TW&utm_campaign=2854360d
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc752146f8,0x7ffc75214708,0x7ffc75214718
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15907998619353242133,8245342428235129066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5500

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Documents\ClearUnblock.potm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Documents\HideStart.pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
126a95f0f380978bbcbbd1fad3c6df1a

SHA1
ee62e8f1732dae36f7ebafc769924a1ec67c8103

SHA256
911f2a3c4cd0c188707bf2e9eb8701a864e38ebe532063c522bbf8d0f525565e

SHA512
01a953a5e6bcadd95f914f75097fa9b9c33e47c2e2a82be3e295eb19cadc6d2a87f402df054c3521ca10c15c6b37d00e29d68d9ff2d7dbd219b9db2112ce43cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
444B

MD5
6326b97a048695c97cb6e26d436f5b55

SHA1
811a44f3052cb03cc39a47b7aaa982d7cf90c0d4

SHA256
c698fca84e7b42e685d303e180104539642abd000527aa40364bbdb4abf9b4f1

SHA512
aace799edf06f53064ea8ef56eed388251d636f593880300e4d8770eec726eaeedf4095faae6e7da0b3243592d29fdc04b334fa92c90e7118ce477e25d2caa88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9db1bc9377e728b384bc5441a4f83593

SHA1
179b24c15f1b78d16644c9dc890f1835e0972caa

SHA256
d1e7a5c1475ded1972803935d36a3f94f50596141e173dad53de36bdbad3c301

SHA512
a6fc9a9a452a2919c835bba5d4bde30de8cba5c190cd7412e4022fc9fc88d74f7d627d267797bde8834aa7be470879155a1e4bd00f249e90feee3c96f636b02b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d66a3a44f36c23c379597bfff6478bd

SHA1
a160ddcc6a46d4324aa0be0e1c08e79b1e578a23

SHA256
022ff9c005e6941473679f5ed6f997d61696a176e149b741b10bb5fb859c9f45

SHA512
e586d00fbf20146623e53f63cd434fa31d5d0038b1d65ae9bef7b250f6d8165e6fc0d880cc1484d81034f7d4dd4c99ca642705efe7bae7b97c239ac348aad8bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b9e2832c877272b69f3291b71a75d4b4

SHA1
193517d66f6676275adc62aa1c4bfd50f25680af

SHA256
4b45cbbb5dbcbb2b1bcc029176af8e0018bea142e2b7f2b0615bed97622ce1c1

SHA512
b804b30e35cd5d20ffa4410dfc46536b2bee46444f449a6bb2f6b42d65cb430536cf935be20c21733275c78cf62e86242bfa3f419ad803eaa607481435b110f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b31470aaac5b8644d3e53dfe217c30ee

SHA1
769928e0853b523242a5d2dcc2b6b96974252f3a

SHA256
ad4f19511687114a57a3d86f138d2e707baa2af706038fddcdb9ced1c96060a5

SHA512
d8411ebad37268505234374285b183d346835b90e5a1cbd42ff345a3f2193934e49415448414c4ee41eb7e0e014250ceece799edcc63a1b29a835225c9d83808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb61e45003b2315f2242ef516d5df669

SHA1
fd378d3d627cae6478ad0deb85938e6dd9f2bbba

SHA256
999dfa5922c0b177ade6e5192765903695e852c564ba32205772883f2900e859

SHA512
5bcbfc21587e62b4d68da12f381f46c85fd31804065bc7f041e6272faa4a0dfa4d5f74e55e5ab5821694ea880f3ae11cabccb826cd8478fd527adde141283977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E8869D3B-48B8-48A4-A9BC-44CBB126D51A

Filesize
161KB

MD5
48fe9f9b9a455806648de04dd7d339fd

SHA1
51066fb82b0c691976d44d35a86af3a18eb6c444

SHA256
7a6b331c537261a68a70cda855456a8497871013610ec1a36b3d4c68072d8361

SHA512
35bd28c6d89424962efa7d3547716c035e5d11c4ab71297adbddab39e1994d79700ba8509dc16098357120d2be37b848c926753722cb25461e2f106071c79606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules.xml

Filesize
372KB

MD5
70b5473b312fd9668a64a5c6884f8b49

SHA1
f853e17c23ff03ac98e08b215fbd7f038548c3bc

SHA256
666459ed16a451d55482fac8108ee0e2dd81029ae4fd4d3d399d23c237aaff02

SHA512
493d126a1f5cb8e2c83c8afb99f2d8c5f4dfc91b4c03fa6b27d627aa25a1afd3574273e7ec146854d3b718ef67eb2a8cea658d7ed354270e3487c59b7a44726a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db

Filesize
24KB

MD5
a6064fc9ce640751e063d9af443990da

SHA1
367a3a7d57bfb3e9a6ec356dfc411a5f14dfde2a

SHA256
5f72c11fd2fa88d8b8bfae1214551f8d5ee07b8895df824fa717ebbcec118a6c

SHA512
0e42dd8e341e2334eda1e19e1a344475ed3a0539a21c70ba2247f480c706ab8e2ff6dbeb790614cbde9fb547699b24e69c85c54e99ed77a08fe7e1d1b4b488d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
fbcfef74fe92c57716d48a330c829dae

SHA1
be1f8c58ae2830efd1e02a659c2911f4b334a24a

SHA256
49f524a19fd796efb0a8b5a543ba62cf624423937e47836a37400037afde9bee

SHA512
e2468823d1164b1728f23ec45419820cbeb038e5f38b07cd50ebe59ca3c5a17ffd2d90ef5afa591da834e156e20ce2fbac4ec87977e94b7b14efdb38859c44e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
fb2cf4b0f67dde90ef26d35b5497ce8f

SHA1
cf71f765c3e233fc0714c81d4369243c6f38bfb9

SHA256
1d7cdc95f79c03d1f3effc44ca5b9c0f54ddc09e27c248fba6e5fc36f1701391

SHA512
3036c898913ffe1a9eb7a850a64abfed8a899ebd9c854038958aba10a922b89c403cdc10b7efb205228cb9527081ef48ba668bb2e7094734decc3272a2b30671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\f3df91c436730d7a37c58d5f25d9bf4a56fa3a34.tbres

Filesize
4KB

MD5
0bcf65c8d2a81e32fc850fe5a297c426

SHA1
cc47e79b84f84556d37649b179fc0341963a06a9

SHA256
7733419f4a034972b26544c5ec32a48f9dbea5b8ab1a3cbed8002a25ce017f6d

SHA512
e8fac957930e1ceae7dad37dde0f46da801b79f6402fd0ab8dad6a8289098df02c4504b57dc28468d53320ec03a81c36b78e96e38441ee6b56002f9a50d47e1f

Download Submit
memory/4400-172-0x00007FFC421F0000-0x00007FFC42200000-memory.dmp

Filesize
64KB

Download
memory/4400-199-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-201-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-198-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-166-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-167-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-168-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-170-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-169-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/4400-171-0x00007FFC421F0000-0x00007FFC42200000-memory.dmp

Filesize
64KB

Download
memory/4400-200-0x00007FFC44490000-0x00007FFC444A0000-memory.dmp

Filesize
64KB

Download
memory/5292-88-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-84-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-87-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-86-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-83-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-89-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-85-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-79-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-78-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download
memory/5292-77-0x0000022FBB320000-0x0000022FBB321000-memory.dmp

Filesize
4KB

Download