9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
Size 894KB
Sample240604-qvn7yahc4v
SHA256 9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b
MD5 984a7dfccfcf530e9898723fe5089e6e
SHA1 cb491dc0402d577c382bbadb2157dfb16495389b
SHA512 95fcf58b75e4dcffde706e737d369a14130f4e951dd228d69b16fe666a5197f92ba8f7dd0ab1194e019c24062d1432cabf8bf0862705bc8fa3eb86d9cf14902c
SSDEEP 12288:JqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4Th:JqDEvCTbMWu7rQYlBQcBiT6rprG8aAh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
3856	msedge.exe
3856	msedge.exe
2080	msedge.exe
2080	msedge.exe
4336	msedge.exe
4336	msedge.exe
700	identity_helper.exe
700	identity_helper.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 3856	4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe	81
PID 4568 wrote to memory of 3856	4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe	81
PID 4568 wrote to memory of 2856	4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe	83
PID 4568 wrote to memory of 2856	4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe	83
PID 3856 wrote to memory of 1632	3856	msedge.exe	85
PID 3856 wrote to memory of 1632	3856	msedge.exe	85
PID 2856 wrote to memory of 4744	2856	msedge.exe	86
PID 2856 wrote to memory of 4744	2856	msedge.exe	86
PID 4568 wrote to memory of 1168	4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe	87
PID 4568 wrote to memory of 1168	4568	9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe	87
PID 1168 wrote to memory of 3464	1168	msedge.exe	88
PID 1168 wrote to memory of 3464	1168	msedge.exe	88
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 4696	3856	msedge.exe	89
PID 3856 wrote to memory of 1672	3856	msedge.exe	90
PID 3856 wrote to memory of 1672	3856	msedge.exe	90
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91
PID 3856 wrote to memory of 1340	3856	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe
"C:\Users\Admin\AppData\Local\Temp\9da54a646f957a8ad502e45a4a20248cab7ef04c6f170154ac1ddff41496204b.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4a7946f8,0x7ffa4a794708,0x7ffa4a794718
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
    3⤵
    PID:2652
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5398429166639451162,14110940730733551695,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5520 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4a7946f8,0x7ffa4a794708,0x7ffa4a794718
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9755644892567625459,13704029956187382059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4a7946f8,0x7ffa4a794708,0x7ffa4a794718
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,17974336227888919764,192940719501772266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

049d74b7-94f2-4d33-a3ee-86dba29b5923.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\049d74b7-94f2-4d33-a3ee-86dba29b5923.tmp
Size 10KB
SHA256 73296ec5ad710e6bf4bd7b708e0b0877bbcd982be5ae310ef83f5f7e0ef533c4
MD5 814f03fb9289ed576d7f4ecc9f5fe7e6
SHA1 91b3bd88e873729e4100a1602654a69d88d9c36f
SHA512 639e22f68c353e2e60a0d2a48592035f33683e10d61d566851a53e3c70f6bdb838843cfa87bece01480c96aec7849e4dc062405a8e7605a0d15ad1e2b5228cd2
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupP7Ve2RUeU65d3z2OMDCRHY:A9iIxuERzA83h09RZxYPFd9daOMWRHqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 65644e865e8864484020bf8225bdde29eb7d2a3c6d5a24f2680ad652e39f0ce3
MD5 1058956fd52d17091330ee675005f31b
SHA1 f57a9f00348b7430a45a236332338d44241d907c
SHA512 7d708381251cd01c6babb9fd81980df0039c72a27040f8ed6aefd022563b914047f34b262a61e29032db5c6d46e54ca842d7564093a411068001de6428d1654d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 11b1c6ed68fec16f76abae0a2ddace8b3b7e256de7adc1192383d6d6dadf1caa
MD5 7598f1e5c1a263a32cc71e26c7855b03
SHA1 ed60f993f7e63711e6664de3ff35a531b35d9665
SHA512 72d1885afa9c41a39eea699904ab2d635c9236a070c202c7680381f9d8b88236b26aa3ed96b3b3a18cff3ddb1c1d7b1cc76e3be747ab7b4abccbbafe518c3fcd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9bcbdbf80ac9ff44e05a0db96c44495d2b8aee927beaf5246fd2ea3859216a38
MD5 c46042dfbfa5ed9ea05b24b1d5a1f0f7
SHA1 ecf4a9c5f86cd77bd129483154930e4213550415
SHA512 e4e6a45a67639273870719431f3fdfae119dac0eef2ac9a76789d5db964fa3058c859f8cb2b03f4b07a69b6a23e090c9ccbc5bbd57e212da91e51eab726bd210
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ac5afbf1e4d5437b819926d4e930bebc8457146b91498d3d814708eae6ed40c9
MD5 f84eacfff6a553e03cc5342f5fce3890
SHA1 c77ff31280d5ed8c936ff193d4f662fa29401b55
SHA512 cb57460f18d2b014d3822075fd31824650061032cac34d4be596ddf6a13f8a8f47c3ab4de541a0e09a5723f764829df22e4ead709a2b981021d905873c11db55
SSDEEP 96:nWkMZ1l33XwpvWMoiVmdeHp1kNG+UWQyV+VDCziEwb:nWkkTnXGWMXpkG+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3c05e096fcc604d148b6cc9656035ae310ae60af06666e311df74460bac919a3
MD5 761fc5f586b9ebf17056125590adc329
SHA1 8a413e6d59775835b743ef7ec71862294b6e112d
SHA512 3ec26a0ade0fbd26f8b7a26a0fbdf13c671054217687dedcecfb960803a53d783123231041271c58896096ab15c55f6e37651a265d3332cd0583622d89f67a54
SSDEEP 96:nWkJZ1tn3XwpaW+OWMoiVmdeaYqMkGBupM1xgxQI1tNGYZtUWQyV+VD7AiEwb:nWk7P3XxW+OWMqYq0ui7gxQIxGYZtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 9655cdb11db96251a2ae57c624b3bb840b3adccdc5a59d2a6855505b3c3a7fae
MD5 a24be82aab8a4bbca70a02d2b9b5cc7c
SHA1 24947016fb2bd07e8b99f82f7beee1ea178b4718
SHA512 7c21d7654a281b23d659896b32146a66a710e094c7d6fdee4e5f8dd9fcbe82f36951b29c23276fea8c33988a398d2efa520731857984de1ec8d51fa107b7cdeb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 535B
SHA256 8ee9d72b9231b4850861790b84cb8f9201e9c077f901d24af05543c92b5d76b6
MD5 12e5494977eb9cbfe3e12c7eb1f7de26
SHA1 07d0d5490c99b93afcd976ebcecc86f1311611be
SHA512 b544270cb2c2367ef025b6ff4c81b0036745725497bb260430ac903d857cfcb438642eb6df521fdae8563d63eabfa8b110419bdcd86d51f68a68324f97122e9d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 531B
SHA256 7b2207c917410424d309a742466981af395df8b194fb028bff8db8d6a21feb27
MD5 192a29f272f4f1eb32f5ddb1c8a2dfcd
SHA1 de64ec8ae2ec5986e6453aa1c22feb841028ec54
SHA512 5b83f7924dbc79fd04a437279f890be289b9a1e08b59e276642c856f03ad9a087965a68c8262886f886c6265b3e86c46815bd00a712d14d275c5a098345666ca
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 531B
SHA256 ead67b2bc503710742ada0e34b5cf856a2e0a67c437b19b97a6ba4a78d1abbaa
MD5 f251fe7e63e52d4ca9ebc1b5e38b280f
SHA1 a4c45b06d81422bcda35ad56852377c6a6022918
SHA512 ce3dbaedc4e41fe6fb3a59c81c11ab775e728fb4bc71f21d94d6ce7bcf9bb598350cedcfd44558e9a277b2f259584d81163cd6447120621d74a60a7b1ef48d89
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe579de6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579de6.TMP
Size 531B
SHA256 fae931fc7bb1770318cacded0ad7343c9a4cdbc17c0a53cc205234b9f145c6e2
MD5 f13330baa9b22c43c3d38b56055ef903
SHA1 02604a3744b2ca73db160e8f0d02547e75297c64
SHA512 589d2ff2b2a6df827f9bc96a2ac407d7b6bd395d07d4b51d3706ece67fca6a22eac911fc369cc9917610c928cf8ab959d76ed785522be92bdcca245a1e799f84
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 755acece0a6b1a582a8a270527944b609d8a52e767f55d570185e0eac7045f45
MD5 3676a57a5f4a31b6b2d26899d4214787
SHA1 a05a7246a4e2b5aa71a710d74a1eb1b1d25dfc85
SHA512 1266f48ef21df2657285ad83a165a86d9dc89390080cf581ada2188e4709c86fd4d83b8da049eb642db346e99bec66f566a96e314e38ad4009d312a2327c47eb
SSDEEP 192:JoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupe78e2RUrB5tk:19iIxuERzA83h09RZxYeGmtk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1bc33685162754940876ef3a27a1663c5654aa464b2c0dde01c55fb27629badd
MD5 940e32fbc0fdc50dc96bc2de91826962
SHA1 80377708f2e6e2518a583ddc6c573ecc2076ac9c
SHA512 8c6add44c78e89e4db6d8f99d9f559616cbdcef0029381f7d15ea91c470abbc82ad8527f3c758423d5b7e3dc61656749e66e6e87bfadbb3f8245bc3a02d66219
SSDEEP 192:JoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupe7Ae2RUdB5tk:19iIxuERzA83h09RZxYeyItk
MD5 SHA1 SHA512 SSDEEP

Submit Download