hxxp://in[.]vipliangmei[.]com/clk?el=ax&ct2=&ec=p86YiJ7X-hpOoJisn2haYW94g-CgN1BAn6smbMgLDwFiTlfpcIX0bwjr5m0n0_4EHwVmmEMuWhRKB519B48FjM8T9j0csepY09nWT3_3BDu1SegD3mCN5EK4HVpf5hnjeKXf5dUM1UJ7X3YqlMM6al49UVBPk6mxXvBk7Ur19478bVXJUfcPP7nOU1yU5Z7hwQF1-MPVFhKjy-jd_yH0mbWJ1MlZLEpHT8FtPgv00oBZ-yyCvfX07sljqJAyuzA0zsQIPVjKWxKlmDMFiVtUhY3GfBpQ6KZcE77HRjygz05OahCp5dij2JfCBLHJUaDTyOuhI_EfYTtwj6pE6QS-wf4xsZlHqIr_HWBlDkub3BNqWFaATh6RikgUJX-9CdH99zzeX3IBQitnKh0zDGmGgUxmr44doMohPGF84TtpYQhyOWTXQegHiN0KdIB-818MjEDy-JF0qee38d4TGQTrIFM23lM43xmz9Ugc0MiWsrnGKSJmWfUse_SJImPrdqxaUsjYupYDJs4sv7kf_624azKoQha_YvM3bo6ktDrVWLB97VrUHWfErGnyfNRkq1g_eZ676-Ih_MUMiz4EVqFe&rd=https%3A%2F%2Fwww[.]farfetch[.]cn&x=cb_down_x&y=cb_down_y&ux=cb_up_x&uy=cb_up_y&uxabs=cb_aup_x&uyabs=cb_aup_y&rw=640&rh=100&tm=1718062545074&tms=__clk_time_s__&dpx=__dp_clk_x__&dpy=__dp_clk_y__&dpux=__dp_clk_up_x__&dpuy=__dp_clk_up_y__&dprw=__DP_WIDTH__&dprh=__DP_HEIGHT__&macros=a_b_c_d_e_f

Analysis

max time kernel
133s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://in.vipliangmei.com/clk?el=ax&ct2=&ec=p86YiJ7X-hpOoJisn2haYW94g-CgN1BAn6smbMgLDwFiTlfpcIX0bwjr5m0n0_4EHwVmmEMuWhRKB519B48FjM8T9j0csepY09nWT3_3BDu1SegD3mCN5EK4HVpf5hnjeKXf5dUM1UJ7X3YqlMM6al49UVBPk6mxXvBk7Ur19478bVXJUfcPP7nOU1yU5Z7hwQF1-MPVFhKjy-jd_yH0mbWJ1MlZLEpHT8FtPgv00oBZ-yyCvfX07sljqJAyuzA0zsQIPVjKWxKlmDMFiVtUhY3GfBpQ6KZcE77HRjygz05OahCp5dij2JfCBLHJUaDTyOuhI_EfYTtwj6pE6QS-wf4xsZlHqIr_HWBlDkub3BNqWFaATh6RikgUJX-9CdH99zzeX3IBQitnKh0zDGmGgUxmr44doMohPGF84TtpYQhyOWTXQegHiN0KdIB-818MjEDy-JF0qee38d4TGQTrIFM23lM43xmz9Ugc0MiWsrnGKSJmWfUse_SJImPrdqxaUsjYupYDJs4sv7kf_624azKoQha_YvM3bo6ktDrVWLB97VrUHWfErGnyfNRkq1g_eZ676-Ih_MUMiz4EVqFe&rd=https%3A%2F%2Fwww.farfetch.cn&x=cb_down_x&y=cb_down_y&ux=cb_up_x&uy=cb_up_y&uxabs=cb_aup_x&uyabs=cb_aup_y&rw=640&rh=100&tm=1718062545074&tms=__clk_time_s__&dpx=__dp_clk_x__&dpy=__dp_clk_y__&dpux=__dp_clk_up_x__&dpuy=__dp_clk_up_y__&dprw=__DP_WIDTH__&dprh=__DP_HEIGHT__&macros=a_b_c_d_e_f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625620484256115"	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
2596	msedge.exe
2596	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
4404	chrome.exe
4404	chrome.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
2596	msedge.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
2596	msedge.exe
4404	chrome.exe
2596	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2472	2596	msedge.exe	82
PID 2596 wrote to memory of 2472	2596	msedge.exe	82
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 3356	2596	msedge.exe	83
PID 2596 wrote to memory of 1364	2596	msedge.exe	84
PID 2596 wrote to memory of 1364	2596	msedge.exe	84
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85
PID 2596 wrote to memory of 1264	2596	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://in.vipliangmei.com/clk?el=ax&ct2=&ec=p86YiJ7X-hpOoJisn2haYW94g-CgN1BAn6smbMgLDwFiTlfpcIX0bwjr5m0n0_4EHwVmmEMuWhRKB519B48FjM8T9j0csepY09nWT3_3BDu1SegD3mCN5EK4HVpf5hnjeKXf5dUM1UJ7X3YqlMM6al49UVBPk6mxXvBk7Ur19478bVXJUfcPP7nOU1yU5Z7hwQF1-MPVFhKjy-jd_yH0mbWJ1MlZLEpHT8FtPgv00oBZ-yyCvfX07sljqJAyuzA0zsQIPVjKWxKlmDMFiVtUhY3GfBpQ6KZcE77HRjygz05OahCp5dij2JfCBLHJUaDTyOuhI_EfYTtwj6pE6QS-wf4xsZlHqIr_HWBlDkub3BNqWFaATh6RikgUJX-9CdH99zzeX3IBQitnKh0zDGmGgUxmr44doMohPGF84TtpYQhyOWTXQegHiN0KdIB-818MjEDy-JF0qee38d4TGQTrIFM23lM43xmz9Ugc0MiWsrnGKSJmWfUse_SJImPrdqxaUsjYupYDJs4sv7kf_624azKoQha_YvM3bo6ktDrVWLB97VrUHWfErGnyfNRkq1g_eZ676-Ih_MUMiz4EVqFe&rd=https%3A%2F%2Fwww.farfetch.cn&x=cb_down_x&y=cb_down_y&ux=cb_up_x&uy=cb_up_y&uxabs=cb_aup_x&uyabs=cb_aup_y&rw=640&rh=100&tm=1718062545074&tms=__clk_time_s__&dpx=__dp_clk_x__&dpy=__dp_clk_y__&dpux=__dp_clk_up_x__&dpuy=__dp_clk_up_y__&dprw=__DP_WIDTH__&dprh=__DP_HEIGHT__&macros=a_b_c_d_e_f
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe44718
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3432 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8095077793736146046,203327634265234799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0d97ab58,0x7fff0d97ab68,0x7fff0d97ab78
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:8
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3044 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4848 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4760 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3360 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4324 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3084 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4356 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3544 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=848 --field-trial-handle=1896,i,17597768953501185122,1402639503324841973,131072 /prefetch:1
  2⤵
  PID:5420

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2115d2b7e72cbc83d0900cceec7515a9

SHA1
3431caf1240a6063b828988b569d546659947a60

SHA256
73df993535981d48119133f7841328b781959ffc7cdf6ed1889c7efff3d4c320

SHA512
4535f6ffbb31797144a1d61685368d7f7b0a8398bb36460701ecabdeb1944e8899286bd8a7a35edcf5279b25e17691bb6552862957a0e274deed54896b3b501c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e90fa0f71c3d5561bcc84e7e6ccfe989

SHA1
3cd0529fc91dee9a8a146eafdc34006889b2dde9

SHA256
c12349c749789125c6bcacc19d775543e39dd57be5427cb9874a390ef7edb36c

SHA512
628bca105b163eecc5746fc98d0b07a2d0e88631c7b0f0e461e710bf6d5ed779f6a8ac57c8b12b9eed2762b03a269b2820c2fb116d4751e790354c94d086af08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
278e29b8953aad941cf83862691e16c2

SHA1
64474bdcb7449f0d33beb586123364428567cc95

SHA256
5aa4974f00f2a2e71b9cd0bea2753923c651aa67d2bb964be411bd13cbdb5aa3

SHA512
951f965dadf4291041d2391f603e3e44b01f5187007f9592a079a1d891a937346d60d65d1ad3d30e48253aa1e70937445fc6d104e2943e7cd43af1cca8c3094a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00cb96449f465b43d57cd56a9c3bae71

SHA1
d22079edf7dce3254c64b0d085363e231f3740ed

SHA256
d0d6a47df01e5882817a9fff28d6feadaa4380c290d9a19c23914543ff74b506

SHA512
1b6ca469bf1996a3bb2442e06a6c1c322f86eaaac712c16d95d75c6ea32c57ae7d97d9e11988367552d236f0fd3c4a5f9b166e6f5434c665d7f9efc69729b63f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c086affd6614d81eaa1e9175b031eb7f

SHA1
a5abac4262a47ad4608e6e79fd8655e845fce871

SHA256
ac7416295a64fdd63740f0ced163ac7a2a8d9dc0d71f5b8408734d1892123fa3

SHA512
02c8c42d267549dff36f5ac9df27bf13d6ba36922515b39edc66d74edeb64360d7604f2e452fed1f70849e907236d3477cb1e1677e6fc4ccef011e3e466aa118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d7dd5b2a4a4a41a826a82329e561cd39

SHA1
3ad36c9a0182e33ec21070fafb6faa1a99e38c97

SHA256
b1ac47c8c463bb85df862a55b58796baedf29dc021053ecb84373d8702a6b7cf

SHA512
54534da35b290abb6fdf871c0334ea49cea3cbdf30f333a4f2d235d8e9b6f2d53f47b23dd3d649992d7335faa72cefdb51774cb891b6ea32a2544832695d22b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
979b89a9d38c8d1cc69acdd242b944c8

SHA1
99dced8fe8b01920234410c71c60ec145b736cb4

SHA256
32303b9d7bd93d1ff99ecaffa48dc5e42b49b898ef10e3c50041661c3004e781

SHA512
35f61be20609fefd16062d03f97b4c25b7b20cbf73ae63d3cb7ebf75b192bd9fc1a072f44b7c9a1bd116eb0fa86a6cc971b10e0a7c18c513774146ef3cc437af

Download Submit