hxxps://sunbibe[.]com/

Analysis

max time kernel
300s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sunbibe.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{EBEBF6A5-1A27-4EDA-BC07-2EE5AAD205FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
1476	msedge.exe
1476	msedge.exe
996	identity_helper.exe
996	identity_helper.exe
5744	msedge.exe
5744	msedge.exe
5272	msedge.exe
5272	msedge.exe
5272	msedge.exe
5272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1488	1476	msedge.exe	82
PID 1476 wrote to memory of 1488	1476	msedge.exe	82
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 3428	1476	msedge.exe	83
PID 1476 wrote to memory of 432	1476	msedge.exe	85
PID 1476 wrote to memory of 432	1476	msedge.exe	85
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86
PID 1476 wrote to memory of 3892	1476	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sunbibe.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb53374718
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,13964741838114113475,7493574359574495308,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f466fe4133b02cf1d6ba00745275ea5e

SHA1
2b046973301393fde3a246ec94a3afe77262a270

SHA256
5f5b5eb0a7b0153f8b3099198d674d79e612d3b583252e501d72105ca683b2d5

SHA512
6b994e8c797265a445d84293677ac77e9730b96cc29d3f65725422f2de6fcd083b31963c3fc7e32baae47dc76957d416835f63bcabc8b378ad0e285377c31222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
345a19587dc0822d931844f71776924b

SHA1
010ed570a184d38754d326c15185055194c99d31

SHA256
14aff7318a96e5848313cfe85b5dd1116a1aa28d7e711f34c33fd12731c1afff

SHA512
efb0ce92c85ff056e0ab396ee079bb069ab6511bf0b73dd4bf82ca7ab8db59770158a9056669b8e4e3e4eabddac55531a0035cf22a1b887392fb016c7a502518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3752834cdb276294ac5a92783fd07e56

SHA1
990b093bd996cde6385b8d31cad7384aa0dcf42f

SHA256
cd1ae7dc3e21960398ed63459efd8e0adde512327c7eadee43149d36ff6b5724

SHA512
c6499f47b731d38087c18c685071139278a784150349388443933c6cedf2c7f5828ef1fd57e06cce36fdae13b5c845cb5c50b6affe95098fa51f8117577a36ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1ff8b40d50faa22c1975c0c9815a50fb

SHA1
c84c48f3343bd1bd5308beb843606662eda55174

SHA256
7f0417da885d0c3cd0b11c1815c920e8f1c4ab8ebf278323f649e198ecddde7d

SHA512
98d6b99b9c1712f750b4acc3ba4d4f587f16ace9eccb03dd5aaae5f6a61186f15520751c8d1bbacea71bf06c1f05272c53a442c83148d734282da1e18fab2e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
069121d9cf3ec52d194889a54d71db9e

SHA1
944b763cfec6eeb125410a3de6201fd6525cfd49

SHA256
7786f17f7cab601799f4773b853d6a8878be43b7c589f9336501663bb2e9f5dd

SHA512
8a8356f9df1dde3c17bbf1ce7622913582a14f9251eb200b5797a097a7edc53d7dc246365da4cf7cb124afb0a5a8ab476771e33a62a99ecbe0aea93f11fcdd0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc6d49e98f6c9c304eb295891e8a55ce

SHA1
210aedd39dd8b3b12a9d76eb19afc4fe1e20e7e9

SHA256
43ebc3c2511d02643d7ae3af8466dca5046aaeb39dc6cc840e2705749dda705a

SHA512
285492ebdebf4f6be1da2dcf8f452fd594bede30bc5fa479acd95643b627c6938458da0a6a7dafd7c9f61e2539d7c8dff79a518fa78708f5bfe4b465ab0eff89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3fa357ea0030193e06ec18188be87b5

SHA1
ef3d203a79133f25b990b9dbe3d5374d41437525

SHA256
088508677ecfde5f0dba7d3668b8e4cb750d1af685f6ad2bc4fbf62f8f0c548a

SHA512
86d0953821bd9d6cd7dc92f52de7ee794c41222e19ffdfd402e14e8dbfd70d28aa9f8141724ee77f6e01a5252190e3d0f9a53f6ea74a136e20331fbc24a62c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
435f473b92b8769008e71d3b395500fc

SHA1
e64eeebc1de1640847b3f6ee7e07250c327f1f3d

SHA256
0843650930aa54e90c51f1f5997294a9f1f2a3b5ea0cc65c8069fdb912d0e4be

SHA512
4cd889ccdd08e2a87179369022ca9c854ce4fec3845cb342f2bc850a4a2f0433b514c29d10cace61d8faffdaf8f07e77126f0565f7d4b387fb359919d910be72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
a602734a6b10523bb565f283a2afeb39

SHA1
8956b853db5ce53fc297068b53a4b4c012ea3815

SHA256
aadc35842711ad71c4a3a14424b063b4eb991c067c3dcb0cbde686be5755316a

SHA512
91f595073a3bfa9e905f7f8fb58a4065e1730db1bfb6e12e960e69b52554079d6091c61323c8b83a2ecca6a89287853f5affc25419e804a3dde6132f98544a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586dc8.TMP

Filesize
48B

MD5
192f381131c266e58f357e6f68aeec8f

SHA1
743980015ae918b376783df5544fa69d4eabdb81

SHA256
e702d6ec331645fda1a6cfb607e6a09a6842fc9b72afecd71e7993b3002b6fb9

SHA512
9455bf10570aa21f0b6ac3a767344810fc3a48e272bfa35b7cc66d82faf361ec34bd1fc99660ad40c340de4d4ca1b05ddeae7bb8dd2cd9b2d2e0a7bc45dd792d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
008a5a21107fd5c51630d83d8f540ef7

SHA1
10d3ee584a24e248fd8d1f710a13d503cee4b981

SHA256
9199ceaf30de348642bb64016bff6bd248a0eb0b1a3210e05ea204a01a97fa0b

SHA512
cba30158d4756ba7da4dcb96981a0db23bc70fcd54f8e268f17ee0555c3e2bfd895c13287c67c686563e346e31b7b45585c25dc9e7a15f8b8fd064e972aadc71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
893bc8fec3f7f51f571840c8fb3e6800

SHA1
cab915e0830b05a8c9c350adb2c0b8364a7538a9

SHA256
bca103a2abe9fda5476331e93d7b4edffb8f70722ea916e9121a9bf8f0cc44f9

SHA512
8faccb6dfe270cc784195b9a39840d83e5e107dbd05ab100f1a45deaeb5515766d1e8466828d36757e746003eb23f4304a607ec067e32a3b08b949717cf040d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b9ca.TMP

Filesize
204B

MD5
43fb2c92fe17bb1db6a4899cc9bf92fb

SHA1
653bc21930d0b720c18db0c6257da2670b1d3049

SHA256
fe00f1b76ccb0e6bd8f7ef678f3ada19c425d336639704f367873b172b17c816

SHA512
86f75723d1bef9e1644e2a1f127934925afd978d77f3acd31cecbd3c14570e69cc0ffa13703573d4528538dbd74d9a6a9912334ef904478fc4f33a7534b7ab00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c88e57f8b6cf5db5abdb1b72856c806

SHA1
fbb63b49f1b7ae6862bc9cdd65c352b0878f318a

SHA256
308f6aa1590465a9c5bdc19811f20355d4607c1321bd85b4e1a9559eb748a2dc

SHA512
2c0566e1d0d1249eb7ac6387b3b3f898c9838a51d3319bfb48b75b6c5a5030a8faf5dc8a98ae6bab7502db9a1b4ac4cd832e4201685a2919ab3987b69a8150ae

Download Submit