4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
Size 894KB
Sample240604-pvlw5sgf88
SHA256 4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc
MD5 67489ec91538617ab19a43620b708d86
SHA1 63b84c1b0281a8308f244f7d99c42d16ee1967f5
SHA512 3c7dccf2a8e6b92410819d804c8409b0009c0ce078bd978e9ecfc6ed274f94ad868670385a905c1b07969d14c3e1f449234c90d2fdb83da8fbc725c1a41fd8ca
SSDEEP 12288:aqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4Tl:aqDEvCTbMWu7rQYlBQcBiT6rprG8aAl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
2036	msedge.exe
2036	msedge.exe
1012	msedge.exe
1012	msedge.exe
1512	msedge.exe
1512	msedge.exe
3960	identity_helper.exe
3960	identity_helper.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1012	1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe	83
PID 1824 wrote to memory of 1012	1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe	83
PID 1824 wrote to memory of 4480	1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe	85
PID 1824 wrote to memory of 4480	1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe	85
PID 1012 wrote to memory of 1640	1012	msedge.exe	86
PID 1012 wrote to memory of 1640	1012	msedge.exe	86
PID 4480 wrote to memory of 3016	4480	msedge.exe	87
PID 4480 wrote to memory of 3016	4480	msedge.exe	87
PID 1824 wrote to memory of 3488	1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe	88
PID 1824 wrote to memory of 3488	1824	4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe	88
PID 3488 wrote to memory of 5040	3488	msedge.exe	89
PID 3488 wrote to memory of 5040	3488	msedge.exe	89
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 2672	1012	msedge.exe	90
PID 1012 wrote to memory of 3108	1012	msedge.exe	91
PID 1012 wrote to memory of 3108	1012	msedge.exe	91
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92
PID 4480 wrote to memory of 4412	4480	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe
"C:\Users\Admin\AppData\Local\Temp\4dcd03e46a4fa6ce15bd09b88273ba6328231b0c662ec9e181a7f4a295c079cc.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ff8420146f8,0x7ff842014708,0x7ff842014718
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,18301338602928986259,13886907674787048126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0xd8,0x7ff8420146f8,0x7ff842014708,0x7ff842014718
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12930180033229128667,8546669356701707460,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12930180033229128667,8546669356701707460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8420146f8,0x7ff842014708,0x7ff842014718
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,768211544942754630,7384005663124393774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2d2fe56a02a2f3ba117287d27b54ff72085ebf6fc3cad00267fbb27b917b72cd
MD5 59b2ca14aa20a36312f39eeaa6eafff6
SHA1 0db3e241fef2b95e9253243a3767c2d8d5482df9
SHA512 be37917d423f0ef49f824c22af1b909080f049680557f1a70f93c6f58b3eceacda560f9b380f33670c55a255865ba063f5e9365cd81d9d4a3dda4f4c2aa15b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d7a350d6119cc6c876d3f1dc4a0d9838cd3e4714c18f681ebc13d891fecc6777
MD5 0d66f45790430ef9ce1ba7c6b7bf2c5e
SHA1 26b743c53528ee72e6a7f4575a51c1c850ff661b
SHA512 2da22dc45276ee8e698f6d42c6765f4b41682cb9ea7e20bd231bc741e8396aa19363af85a82ad52809c1f4bcc59b3b65a57924c75f1190ddf8c0cb6ba8a1163f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 6d0bad2846784b11f0215bdab94f48f34b6f3d2aaa8be582620b2eda6ce54d3c
MD5 a4f8565f8ce2595d8ec8c0cbbe1d9529
SHA1 d69e654f165b04602e75059b745ced7422aa4a4a
SHA512 f80fe7cec3a6ff53e4bf1fedf21141c80f10d2cffad05d0fe5c697d84174c616ba9def93640bc7b237d9e92eefe7af10fa8b1fe5f996b95f944648ac0d2815bb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 662e1e101285466903ec2947e379e7724bcb75fd5f3cdcb6378288c89a502a6b
MD5 e188954dad345c7b46a3d30e9a7e5b20
SHA1 c73fa60a3a514cbcd75397f49024ec03f8e9cfd7
SHA512 b71d15e6864d4856b557f39986099457a22c2edeba9d255f011aada4e7b4096ba0d2ed06427a99d4e8e6bb138f8792acf3394157b39c55f8242f591b171f4c46
SSDEEP 96:nonkf491egjuwpvWMoiVmdeHvSS7Pb4svUWQyV+VDCziEwb:nokeMgjuGWMXpLro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ee8710657d9c4ee11d28a2f22f6dd1a882d9a43c204cc2beed38ac9f3089d9a4
MD5 b2c707da99049283a8b4e4fb0794252d
SHA1 d894b9db65d79fe9a7567e184ea20cbb7043a2af
SHA512 bbd0fa9d946934df5289bded4230f2134032efa12a41b08a10c8e34184916ef0906a2cf7836563ec1e16f2d2e67ca9a4fca6ab33376b1c94077f007e779bdcef
SSDEEP 96:nonk2491ewjuwp7p8v9WMoiVmdeXYfSMkvuRS1ogQQKSG7Pb4se/UWQyV+VD7Aih:nokZMwjuCSv9WMnYK7ugqgQQeIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 533B
SHA256 c68e6d5a984e5b29db89a7df9b94d754aa002ec1e29eca4469772d55e88f6a98
MD5 eaf01ea633fd1c230cf7c6a5d67c2158
SHA1 f176ba711838eaf4f036abed729d6aea977d0d9d
SHA512 c1c422d72b0ea2f99f37a7de9a35212fe37c8014c8ba7671222cf5b0901b530bef3cd0561217a8b7c761a56246453a37a8538ec6ebeff9adbb6730f9de3591a3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 533B
SHA256 1624e0b980ddab4042dc5e84e11b9a7f932093cf5d31d750995db967365b86ea
MD5 565ec2e294f7397a77e58d61317d0326
SHA1 6c6c237b2cc369e1129f1b988d258e2abafbb55c
SHA512 1a7a5d6b1dd8eb82982d0d9979ec80eb846021d2c1740f95b835d6c44cf143476764c2b37897ba730176132b0cf8976d564fd0cb7aaf684881328979773716e1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 533B
SHA256 b15cbb702b2be3c9c4871928993d0ce824908b650350a042e51a94f573508aca
MD5 4cb998a54b58241d926244dba97eb910
SHA1 502317996109fbaa1bb3a132937256dc606f4c7b
SHA512 7c0b3d13df91cc2f1d4453fd615760a7fbf283698df4d9dda997e71652c36cdcb341e74331c7799e05b02c4ed004d457fdf7d3013e3535653c3423695f2acddf
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 533B
SHA256 c6c6e056d72a1dfa243cad0b2aef8c5de293f336be46b8e6d989dcd44535887b
MD5 0949fb8992a62ce31bb2b82367ed6612
SHA1 68117524e3c3ae1695a446816ad0006739ab7572
SHA512 7c5ebec987248148ff64e0ad13676e73740a91aed69432dfe32805702a8d5ccf6f73c87c171115f322d176162809575e43148d5ff1f8df53f7d7792d34610a81
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 533B
SHA256 849e6cd18a70a39e87516acb4756b863cb05ecb410bc8c62566928a7f5931f33
MD5 36b1613d24a4ec6a82150f4a745373c8
SHA1 794574ff8269d7f74084b05c671cd1c18e9b0f6b
SHA512 512e595b3ece336bd7cf53e42901da7624db385905952adb7210359299b0ea7b311150282ee5af2ab9c2105415c08b9c15197d03b60ae5cd56ef8f5ade8144b4
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a596.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a596.TMP
Size 533B
SHA256 47e9d3ab1e16ada914072ad039dae97708a1c79f9561ce3d519c31f96d0c261d
MD5 eedd3e62cd6866d4932ee2e3b0cf9347
SHA1 3abebf57ac0ba3c5b180d2e49a726792c8f43634
SHA512 459184576483cd31179bf04afbec9592f280e5bc5a19527ce23ac551fbda30436c9b8fb0ab009af4ba768fa859cbf12895f42a36dc5423ef284e8c8905e3834e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6a20d0096f2a407f1930b503a880e765d99ca03e03c9521f3be080414465dd4f
MD5 71328d0f8ab69a7336c853ba593a4208
SHA1 0a63981a495424fc7c1cec83df1cd07c7236c5ff
SHA512 e8cbabed4c85b2a6d5442630284fa2b32e252753adae93c9792ce1f6c46dc926370caf6214faa693f8e91de1f90d084adc379c1418e8a6386a04d8377743ae54
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCBe2RUULqu43z2OMDCRHq4:A9iIxuERzA83h09RZxYCVbt4aOMWRHq4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ae7a60b18d214f5665a8f19b5516f4e9998ceb04a8116ef3a4bd496871c40173
MD5 acca8d8aa6a3cf616edfd1ed6777f61f
SHA1 8f7da07548fb8cffc1b7d7f229d148b5f510fe4c
SHA512 d13a43c8975efb2b3ee1bf5c98dd611edc15120f500deb50cf95c77e0a0858a063ade693f32517c7c15579af717758f77a245b408da6f446c7bc4b0f79f2def7
SSDEEP 192:ToCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupire2RUvRu6p:z9iIxuERzA83h09RZxYi7L+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be58541aac157072de36523313f289b6e67571082238f68c5882fabd58e1089a
MD5 87d02eb70e9f6d0606f61c6ffc23f744
SHA1 624213faada065a7c30440615056f6c500077d6b
SHA512 8d37dbd95c78de82ce37c7b26060b512b4b4c150e2c3e087d46cb392a0f3906ad39b70276b849baa49f840060f9cd16d95939316177f81f0437b0318f84c9b01
SSDEEP 192:ToCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupije2RUARuLp:z9iIxuERzA83h09RZxYizQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download