Resubmissions
15-06-2024 00:12
240615-ahgpbssbnh 115-06-2024 00:10
240615-agjgjawbkn 415-06-2024 00:08
240615-afdvnawaqp 115-06-2024 00:04
240615-acz9gs1hqh 6Analysis
-
max time kernel
88s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 00:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Google.com
Resource
win10v2004-20240508-en
General
-
Target
http://Google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exechrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628838032552973" chrome.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exechrome.exepid process 4124 msedge.exe 4124 msedge.exe 3360 msedge.exe 3360 msedge.exe 3216 identity_helper.exe 3216 identity_helper.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid 4 4 4 4 4 644 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
Processes:
msedge.exechrome.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
Processes:
msedge.exechrome.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
msedge.exechrome.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3360 wrote to memory of 4904 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4904 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2468 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4124 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4124 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 920 3360 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8b2046f8,0x7ffe8b204708,0x7ffe8b2047182⤵PID:4904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:2468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2248
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4192
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:82⤵PID:3464
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:12⤵PID:2184
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:3868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:4684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:3760
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:608
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:12⤵PID:2948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:3080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,17895555286756392196,1273176645351202717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:12⤵PID:4428
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2088
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3516
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1500 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe8af4ab58,0x7ffe8af4ab68,0x7ffe8af4ab782⤵PID:3472
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:22⤵PID:3076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:82⤵PID:4324
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:82⤵PID:1464
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:4896
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:1564
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:428
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4072 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:82⤵PID:4028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:82⤵PID:2432
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4456 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:244
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4460 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:1168
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4256 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:612
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4120 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:4288
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3912 --field-trial-handle=1788,i,4942407943860975089,14557010731995747758,131072 /prefetch:12⤵PID:1732
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD505b1297f2d6d37146cdcef867125f6f8
SHA12f05716923f0eb38c9c2f9cb69aba4a1d065f716
SHA256cff1a5af36ecf2c499c20f8ca5fbef52f0c020dac08509e2485ff22d5652799c
SHA512657aaabf3af2abc19f1a0cacb1c17771a076182bdfef95147267f1427417489ca770e7ac8f605dbb2f35569f8ae0fa86b1adf4d606e530426d0ae792c5cbfdee
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD560291578c65e817176dc64ffdbfa85cf
SHA1dd9d5342feae1bc1799360441e5b86631722014a
SHA25619ec3b231c604c1c45478f86dedabb114957086f179a1a72831ab296d56cf2d3
SHA512b2f01693c42eee1db079bfefde96d637f329903fb85d39e3b630fba2c37e5dd6203d5a1e16c96027adbbe758fbec7940a2d3567355f52d70c858d211d7ec4e9e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD51b8cdf6f7a11fdbc1d96473e19aa18dd
SHA1af3e833a96385786455baae8262eb8ffd0c3eaf3
SHA2568bfa51760476003eb03766f3f9da44aca2de58936ff3b9e442bcdf486ab262b3
SHA51207b2a9f253e490fa7896d3f854bd36c0ccdc1fdaf7a18f5b4a031cd66dfcc4389f6dd4cc71b9868b19af83ce792e5dbee53108aa56037da9bb8613156648978c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54d26e3959631b40e6a383f5ac849066c
SHA13366fdd0896750f528139f94e1a10258515720e4
SHA25663723c543640dd8b478df448f9d2373662e766013c3a7f26cbe1cf79622c8672
SHA5120f04c773c63a2a5716830087d8e08b97e600dd30c0ce108f2a4aa3343bb88d511b14f5da5143e0635023ed1162eb5ce3fe4afb6cb9ebe693f76cafcd447a066f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5fbd5d97fbec6227cd1632c1d922a5387
SHA1252c1fba924f9767ed26169d94ccf6035917f5cd
SHA25697a2344cbbbdf6c44120bfc9572c138779e86b9cba2f7d30ee3555a5446b6359
SHA5124ee9d93352b2afcb1867efcd573aa131d8423adfcd3b4c3df074b0cb00cbb3935ea513f036101a8862a9041b9b1197e9050fba25a83b54613fccbf5dcdeaa2a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD543591ea4c734e2cf15ef57cd1384c60e
SHA182d54dc0bd699aaf14966c9ba10a9f5c82f2ab5b
SHA2561f739175e03e3af5869f9dab16e81c6b283793826e0d2f08c1f30fdb4d2d97c4
SHA5125c749808266686ba380ecdc8d79ad5b51c2d8a249ca2e78019b30c717d9099e28efc461e271aa5c593c890a3a01da0ae4c4444bb19718f7b60f89440a0e3cea6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5abaa4d3427d3f86c78482374373cb235
SHA163a6e9daa863b7a05a8d4ffda4f69e248b082c95
SHA256d01522074289a30d73c05d4615a5940185fd718590427e982cb00f4a235f8cae
SHA512d6c14ffab96c77c5db3e75a57cd1e2677c6b7f45ec05c2e88f54a815dd90ae679cfbb4be60ba87f6664e45af72a378df9805f71aa5aac56fbe4c6bb807a02908
-
\??\pipe\LOCAL\crashpad_3360_OSWAPEIWKZUIEOUMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e