Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-06-2024 10:26
Static task
static1
Behavioral task
behavioral1
Sample
butterflyondesktop.exe
Resource
win11-20240508-en
General
-
Target
butterflyondesktop.exe
-
Size
2.8MB
-
MD5
1535aa21451192109b86be9bcc7c4345
-
SHA1
1af211c686c4d4bf0239ed6620358a19691cf88c
-
SHA256
4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6
-
SHA512
1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da
-
SSDEEP
49152:5aA7f7tlVmdqK23H2bpHI4Qs5ABV9WRHZRsgI82lcHGAaKLinXBgJ:Q+VMkX224QsWBq5SfARGRgJ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
butterflyondesktop.tmpButterflyOnDesktop.exepid process 1984 butterflyondesktop.tmp 3712 ButterflyOnDesktop.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
butterflyondesktop.tmpdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\ButterflyOnDesktop butterflyondesktop.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
Processes:
butterflyondesktop.tmpdescription ioc process File created C:\Program Files (x86)\Butterfly on Desktop\is-38N5M.tmp butterflyondesktop.tmp File created C:\Program Files (x86)\Butterfly on Desktop\is-EVN64.tmp butterflyondesktop.tmp File created C:\Program Files (x86)\Butterfly on Desktop\is-E50NJ.tmp butterflyondesktop.tmp File opened for modification C:\Program Files (x86)\Butterfly on Desktop\unins000.dat butterflyondesktop.tmp File created C:\Program Files (x86)\Butterfly on Desktop\unins000.dat butterflyondesktop.tmp File created C:\Program Files (x86)\Butterfly on Desktop\is-7F5A2.tmp butterflyondesktop.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exeWINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 29 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" WINWORD.EXE Key created \Registry\User\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\NotificationData WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 3a002e80922b16d365937a46956b92703aca08af260001002600efbe110000002657a4bd47a1da01bdc2fb614aa1da01eee383c3a0b5da0114000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" WINWORD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4288 WINWORD.EXE 4288 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1172 msedge.exe 1172 msedge.exe 1152 msedge.exe 1152 msedge.exe 4536 identity_helper.exe 4536 identity_helper.exe 856 msedge.exe 856 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
butterflyondesktop.tmpButterflyOnDesktop.exemsedge.exepid process 1984 butterflyondesktop.tmp 3712 ButterflyOnDesktop.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe -
Suspicious use of SendNotifyMessage 13 IoCs
Processes:
ButterflyOnDesktop.exemsedge.exepid process 3712 ButterflyOnDesktop.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe 1152 msedge.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
WINWORD.EXEpid process 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
butterflyondesktop.exebutterflyondesktop.tmpmsedge.exedescription pid process target process PID 2600 wrote to memory of 1984 2600 butterflyondesktop.exe butterflyondesktop.tmp PID 2600 wrote to memory of 1984 2600 butterflyondesktop.exe butterflyondesktop.tmp PID 2600 wrote to memory of 1984 2600 butterflyondesktop.exe butterflyondesktop.tmp PID 1984 wrote to memory of 3712 1984 butterflyondesktop.tmp ButterflyOnDesktop.exe PID 1984 wrote to memory of 3712 1984 butterflyondesktop.tmp ButterflyOnDesktop.exe PID 1984 wrote to memory of 3712 1984 butterflyondesktop.tmp ButterflyOnDesktop.exe PID 1984 wrote to memory of 1152 1984 butterflyondesktop.tmp msedge.exe PID 1984 wrote to memory of 1152 1984 butterflyondesktop.tmp msedge.exe PID 1152 wrote to memory of 4776 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 4776 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1948 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1172 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1172 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe PID 1152 wrote to memory of 1124 1152 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\butterflyondesktop.exe"C:\Users\Admin\AppData\Local\Temp\butterflyondesktop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\is-VRSQ5.tmp\butterflyondesktop.tmp"C:\Users\Admin\AppData\Local\Temp\is-VRSQ5.tmp\butterflyondesktop.tmp" /SL5="$500D6,2719719,54272,C:\Users\Admin\AppData\Local\Temp\butterflyondesktop.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"C:\Program Files (x86)\Butterfly on Desktop\ButterflyOnDesktop.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://freedesktopsoft.com/butterflyondesktoplike.html3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff972fd3cb8,0x7ff972fd3cc8,0x7ff972fd3cd84⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:24⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:84⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:14⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:14⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:14⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:14⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:14⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2456 /prefetch:14⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:14⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,14119727829044023630,13384157511621077461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1700
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ReceiveWatch.vbe"1⤵PID:2688
-
C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD581aab57e0ef37ddff02d0106ced6b91e
SHA16e3895b350ef1545902bd23e7162dfce4c64e029
SHA256a70f9e100dddb177f68ee7339b327a20cd9289fae09dcdce3dbcbc3e86756287
SHA512a651d0a526d31036a302f7ef1ee2273bb7c29b5206c9b17339baa149dd13958ca63db827d09b4e12202e44d79aac2e864522aca1228118ba3dcd259fe1fcf717
-
Filesize
152B
MD5c1c7e2f451eb3836d23007799bc21d5f
SHA111a25f6055210aa7f99d77346b0d4f1dc123ce79
SHA256429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800
SHA5122ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34
-
Filesize
152B
MD56876cbd342d4d6b236f44f52c50f780f
SHA1a215cf6a499bfb67a3266d211844ec4c82128d83
SHA256ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e
SHA512dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039
-
Filesize
816B
MD58440b9de9a3d3e36d7980fdcf08ce83c
SHA1a41d533b5372ffed0c097ff97208c833d4fdd7dd
SHA256adb4ef51f8eeb75683250489a487af54030b4d0626708b09f29335880c616fbc
SHA51279c636a864d58875004d410c21e864d72fd30b8d13d1435105c1850357ffd8635f5c8b26b010e7019180654bb794ed0adb3489e0e22800d123da72a26749592e
-
Filesize
2KB
MD50b4e4ece055c40ae12c8d5a22c51111d
SHA1684ce63c8433a8af972d09fe26252c8ae5a53794
SHA256da6fa0f50000b3f9686c4151d97d9fa1a6a5e401f24442d7d5b3061ff19967e6
SHA51219a64c39a000508ecab34f15f69516ba96922eda4f9c0dbcc5ff1a328661164bc91ee21e9219ee2e47f64883dd20606580cf8631bf107f83542313bd876accf0
-
Filesize
5KB
MD5364bbbe3ad1fd1eba97b77a456f1802e
SHA1c9b38378f072636935264ed91888875ab2d1ba0d
SHA2567bee15224a7d75774093146ab1266f1c9ec1959f67e50c9178ee9ab4b886cd84
SHA5121b8b7ef58ffde22b9364a3b25fc86452b36bb3a8e6cce5f5d43765f0ac0ee573ce38502eab5cc84b6d82a8c68b5714e0441d58f76c2b33aa15e46a3164c0eaa8
-
Filesize
7KB
MD58599c232d682d7911a8aef009d7d2ac3
SHA1ee0fd5a4671a8ac7649a746295e416f9e7f14d28
SHA256f6955798b5bb72bb3260f54252c1ff13c875275437e410fcf9e2a14eb506f381
SHA512c8792f2ac42f0fa84a47d667e6daf22c1a9c75fdae65f94decab4b2cb0776d884c66f6daec315515a0787f646ca47fd58e4b16095fffae3cfb21a05c007be6f5
-
Filesize
7KB
MD5f6c41062399f4105dadfd36f73ab046e
SHA165f91e0882d57d0af36441885f2712db7e042299
SHA2569be0645167dd5b43009e8a28500b5deb7b4c6941dc4294677083bddfef4f69fc
SHA5127fa9be4000f5d6d73a31310c9038920753f10fdd493b1d6b5d73d27b7b8727647e1b6e38ad8cc154d5139984951cdb5f893ba283233a8ca94826587729a32220
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD534bfa6a81abfb5b2e47705a934db3746
SHA1fce4726e57c9d84d22677ce25969ee9d3f269b44
SHA256ff5c36a40595d85a6aa0e4004af252844549dff72f4afc03d897e5cebb98a00f
SHA51224a83b928d0619d29302204bfa969f5db863bf14a996bfe537a07510efef2134c837a94ea73831d70349bc66e26830a2dbe1e339ad4119facfb672b65958f591
-
Filesize
11KB
MD5b0fa6eae70e89790caccca1761b418cb
SHA116d8ea0aa0a767771134a819b1945cf66b3f39de
SHA256bf8c198ffb5c3c20492ad5a13aed4902f30f966441580f4240ce25a6caa69cbb
SHA512cd3503f46f0d7c1d84dc975ce4109ab1b26a8bd25c77348c55e1744d18d54d4606637f1517caf29c459aa7901139d1d48301d1ce3d2bf17da9c7a5e4e908dab8
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\541B0C51-94F6-413F-B8E6-9A0E530FEADD
Filesize397B
MD52f82426450332b558a61ae9ca551abd9
SHA1abdbf8f8bdd7572bcdefbd1e0b7da8d3cf17144d
SHA25657d6315a8f1f11aaa111a9956ddd0d560f791f757c379ed77bbb5a1b5b577f52
SHA512dbc43dab6cbde98647c5a88cd508a1528ef79c030286cf82cb4cb03c4af81930ad1c3b2644ead9eceea27cd5772324f42a51f04f1693102254567205a6abf0b5
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\B0B01AA6-B0BA-4BF9-91B3-8713C95884D4
Filesize1KB
MD585ad173999ed440af6120f3b4fd436fa
SHA1eebe3bae40b0c82db581b905e2a4c4a90055c9b3
SHA2562fb3e7ca57b5ec8657ff2b909c74dee246e7ed2b30abd60dec96fc4fb88bd165
SHA5123c506252a27bc4a3d718fc2ad89036850ee3c9d5fd79966fc5e28debe1844d96e8d2777e160e8537034129fd8109dff027bf5eb4a082c99d0db93730ec31427e
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
11KB
MD5f2ff44eba9a136f44e1df1ffd64fee64
SHA1f3789eec13e9f032d706228df98112ed0c86b806
SHA25691dba992d7f6d1827cb00c7e1e04ff87381348afa35bd51cb789e10429e770ed
SHA5123dda4ce945cf472fa3310170e228ae63709f2776e906161cae720901bb0d8189f93e6c7dbcc9cf5bb535762d91248aab1cdc11ee702ee7a3d9c32a31c6d3c88b
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e