Resubmissions
25-06-2024 10:28
240625-mhrwhsxdln 325-06-2024 10:27
240625-mg7wcaxdjk 325-06-2024 08:54
240625-kt32tatanr 320-06-2024 10:33
240620-mlkavasfpg 314-06-2024 11:00
240614-m4d7jsxfrc 314-06-2024 10:50
240614-mxppps1ekk 314-06-2024 10:39
240614-mp8gvaxbjc 311-06-2024 10:04
240611-l3yn5atcmn 311-06-2024 09:55
240611-lx1arssfle 611-06-2024 09:53
240611-lw1j5staqm 3Analysis
-
max time kernel
80s -
max time network
88s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-06-2024 09:53
Static task
static1
Behavioral task
behavioral1
Sample
b28242123ed2cf6000f0aa036844bd29.dll
Resource
win11-20240508-en
General
-
Target
b28242123ed2cf6000f0aa036844bd29.dll
-
Size
87KB
-
MD5
b28242123ed2cf6000f0aa036844bd29
-
SHA1
915f41a6c59ed743803ea0ddde08927ffd623586
-
SHA256
fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
-
SHA512
08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
-
SSDEEP
1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1144 5028 WerFault.exe regsvr32.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133625733032423985" chrome.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exechrome.exepid process 1624 msedge.exe 1624 msedge.exe 3756 msedge.exe 3756 msedge.exe 3356 msedge.exe 3356 msedge.exe 3156 identity_helper.exe 3156 identity_helper.exe 4132 chrome.exe 4132 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
Processes:
msedge.exechrome.exepid process 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 3756 msedge.exe 3756 msedge.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe Token: SeShutdownPrivilege 4132 chrome.exe Token: SeCreatePagefilePrivilege 4132 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
msedge.exechrome.exepid process 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exechrome.exepid process 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 3756 msedge.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe 4132 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exemsedge.exedescription pid process target process PID 3744 wrote to memory of 5028 3744 regsvr32.exe regsvr32.exe PID 3744 wrote to memory of 5028 3744 regsvr32.exe regsvr32.exe PID 3744 wrote to memory of 5028 3744 regsvr32.exe regsvr32.exe PID 3756 wrote to memory of 4144 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4144 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 2960 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 1624 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 1624 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe PID 3756 wrote to memory of 4540 3756 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 4523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5028 -ip 50281⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff837ea3cb8,0x7ff837ea3cc8,0x7ff837ea3cd82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,17771967480409126591,1056246759962013166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff826bbab58,0x7ff826bbab68,0x7ff826bbab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4176 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4828 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4700 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3508 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4060 --field-trial-handle=1880,i,8609559881428045264,2979550564846928574,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5a262db8fde7629e5dc5f6821de714d25
SHA193499cbc502a6e1032e3d28f29c9c382c69dd3fb
SHA256033c4aa44d2564dc25477a2c99d6abd13323410f0142217aa90e797e3fd41d96
SHA5129db15eb8d2717978e7c82819895ded481f8c9a083ff95e0270751a283aaf3e64105f9a14a4726a9f7e838c65997f6b7d93b40f653006781307d2f2e1be50c8a1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD5755a6021798774590a07f4cda358733d
SHA11cc264caf73893b76bae8304f7abb9ee78d6fd45
SHA2566c6569c432d60f4cebf153b9e215b59b8b21eecf9dab427fc946b62801d8ed96
SHA512b1fa9d46cc38407ee6d93f2a07fa80c2b0345ca05ebd619b2acf0cc64418c98b2603f6498d869cc8205ed1af5acd9aaef25629d7cfebeead848339a3bb41ae2c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5390187670cb1e0eb022f4f7735263e82
SHA1ea1401ccf6bf54e688a0dc9e6946eae7353b26f1
SHA2563e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947
SHA512602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58294f1821fd3419c0a42b389d19ecfc6
SHA1cd4982751377c2904a1d3c58e801fa013ea27533
SHA25692a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a
SHA512372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD57aa63826ed334a050a9e262ab0b8fc86
SHA1c27a86a194175730131eda871c2320c4f3ce6244
SHA256f11bf15ae024686829b10b29d4501d8cbd593a0585ab58de2ac5d062a42c795b
SHA512cb6182e781e8bd06928f57600d3584e519544b0c51b86091f09e81a4123019e989add6a650b0e99aa589a2e75201b9daa21ed160742fc668b9ff53268357f5e5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD53cfe26208a73416a772173f5278b0657
SHA18bb22ab06a7c16d94888eb23bb42487e16f7b882
SHA256f802fb91262f46ab0f4f812aacf16089921898252b71e7c525d2acc7c4563b8c
SHA512f5dc4626cd3ebdb9a17c9395c48453caa42843a03384c458887fa1bf47dba8c003cace004dac2ebdc77ba4a174199a00154acd85489cd776ca3d665fefdfb493
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5d74dc41a2654266f20f3eb50a8ba5b6e
SHA156c1566356763ef0f5a81dea1c76c7d9e1a4fe7c
SHA25641ff720d8ba2a6b3f91b782ce53f71c4c6b0e99454411f0120ccb107bf1f8bec
SHA512671da02fb0465492bad9a6aee112b13311ea5fc08bce6b917f57b2a6638aee0bbce2e01e39d706f8f7823c7815d9e5a49129a1c87e4d224dad654abafc65c39c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5de59e24f5df6df3b0214456736e91931
SHA1ca66306b4983259a1286101d6fab97504ae8364f
SHA2566fdb08dd638159cc128c5970af1758f2ea0fc7203b5f22bae47b14b7e14b986d
SHA51200cd9e4878ddf7c45f66b5934be90575582aee265f632943e088c3e750f3c1a1c8fea34857378c4a5730cf426bd5f2cf3ad11c53a822c0d25b2c3255f786c3c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD50dd581f99ced9da748f24e2cb9c566b2
SHA1fb41dd1484b9a62e1028049ba8939d1127a4a90c
SHA256b8c51654c9ba8acda02e2ac904eb870ccf635969747612b1ff11551854d14db6
SHA51288d2d4a13d62ababd992992844d58e8f89d17c268786f2cb64536a28dbc22ae279031684b3748df9efc443a4a45d1c80ecfffd2e38d318dc15b85bef8f2cd0ae
-
\??\pipe\LOCAL\crashpad_3756_VHDKWHOVPCFNQJQFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/5028-0-0x0000000000930000-0x0000000000973000-memory.dmpFilesize
268KB