hxxps://simuos[.]com/visionos/

Resubmissions

17/06/2024, 08:14

240617-j4zxgasale 5

17/06/2024, 08:08

240617-j1szrawamj 1

Analysis

max time kernel
98s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
17/06/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://simuos.com/visionos/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133630855348022111"	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
2280	msedge.exe
2280	msedge.exe
2272	msedge.exe
2272	msedge.exe
1600	identity_helper.exe
1600	identity_helper.exe
4816	msedge.exe
4816	msedge.exe
552	chrome.exe
552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
2272	msedge.exe
2272	msedge.exe
552	chrome.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
552	chrome.exe
2272	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe
Token: SeShutdownPrivilege	552	chrome.exe
Token: SeCreatePagefilePrivilege	552	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
552	chrome.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3040	552	chrome.exe	77
PID 552 wrote to memory of 3040	552	chrome.exe	77
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1464	552	chrome.exe	78
PID 552 wrote to memory of 1324	552	chrome.exe	79
PID 552 wrote to memory of 1324	552	chrome.exe	79
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80
PID 552 wrote to memory of 2672	552	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://simuos.com/visionos/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd244bab58,0x7ffd244bab68,0x7ffd244bab78
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4556 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4432 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3068 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4668 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3256 --field-trial-handle=1856,i,10846093379101746022,12645856586120672153,131072 /prefetch:1
  2⤵
  PID:2968

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd10ab3cb8,0x7ffd10ab3cc8,0x7ffd10ab3cd8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17938159792428095450,6907947249981253662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:1
  2⤵
  PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
df23d785206ca4cf6c6532085556de2f

SHA1
a649b379b05895e16374a59f5d7a1fb1e7955087

SHA256
93bd1c009402826599d6f495b5b0ee0e92740c7c3e94255926f1941b4c689238

SHA512
ec1f5c90213ff396924e5202a78c9d259e17abb2efe185430553d13251e3919d36dafcc90c54777a215b25241fe3213e23cc959a574976acc5f37fc5cd812313

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6b7eaaae076a2025015d9113994ab401

SHA1
c09cbf64713dd2c3d05e4b114502289b18602881

SHA256
7aae1d893f8339561349349234bc3101faba254a1da823f4ac38b569df64db36

SHA512
8f993dde02104b2232f26ff7306b8d558b7e09f20cd26408a2eeeaf3e6e285f566f44ff4a868e3160cfd058c322dec99285964d8891ed9f15ba967c3e13f0bb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
6b4462cbec586637b851d7fb005822d0

SHA1
91cecdf18e63b994f7cd6a26c7c093f4c9f672f9

SHA256
b34a67ce214a4017ce6a02c257fff9b2fb1d5ade1de595df516e3dcbf34a6645

SHA512
6bd42be05c2ac84e350c47254f2bdabda484a84bb5e5cbc14af40f3d62bad3e0fdb6f8a4c13dd6f6508ec20befbd9e821e9e4dc184421561794325c9ce9f9888

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
df6c729a4d1cbbb8108632c7903602ee

SHA1
5e2ecaeda2ea42d3e1adee515aedc1ba6ea113d2

SHA256
54e1f54104ea19236fa3f04cd8b39ebe90a2577d740a5c520fb5f8a04a50d60f

SHA512
0cba31eedca01f18b32d7a2688923fc4320ec13bb06c6aafea2416bdfa3c940b5b166f2194e7d98c8b5a602357674c67f9ea9b762cd704d57914f786185fefd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
85KB

MD5
954ccdefdee949b79bba3e178112c1cc

SHA1
1797cba1c972ab28ba89c66f60a75de41973cdbf

SHA256
140e5c8f75c51ac826cac193fafcaa8a41ee5976dd29ede08096abb97a9de87d

SHA512
d152d1ef52bf798f89614b0ff1cde7d1375d25ce8e418cfeaa56c1176dc7d7885639b03550b743be46694024929f188915e0ff9af02c74328cd08f0996017f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57fd1d.TMP

Filesize
82KB

MD5
52733e65f49a02d14ad2e45b60aeb804

SHA1
3d8d738e729357bf0d08ebd8801a966bb454858d

SHA256
e13240dce270c040c5f27ed2b9adb82d64e18198e8032073edf3bfeba9edf102

SHA512
ef23de2633e492ea70a2268bf63ccbd6dc33a24e37362c94ae0a8f30e2c32ae1370ea27de28af52a61cc4c28a2db4da62df6e1bbeaba0fccd1ba711d894897b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f2eb94e31cadfb6eb07e6bbe61ef7ae

SHA1
3f42b0d5a90408689e7f7941f8db72a67d5a2eab

SHA256
d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de

SHA512
9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d56e8f308a28ac4183257a7950ab5c89

SHA1
044969c58cef041a073c2d132fa66ccc1ee553fe

SHA256
0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae

SHA512
fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d0d7e74476de1f061d0b157530bbfa7

SHA1
7fd663291e6da68a02d16e34565446f251b2b8e0

SHA256
ff73381cdc296667d9a6ea942b1e00956f421294a5dcaff5294bc4bc6c89b7b2

SHA512
91ce64efd90ac71535eaea4ee58a9dd3a07224e8c0ef2241930c620e1210f94fb7163752c6115f6096119da87761f75e5b118c900264f8ca04e8eee0e0429ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d71f7e48070948514f4c27fc58b0663f

SHA1
35a37d880f7845f18669b22adc1b0306bd58c946

SHA256
3af83b4c7dc9087834c1f69f745633dc0e9ac083bacd9402f045f5c407268ebf

SHA512
c65064ca7a8d403fe06ca9e5a3edfde2337a7af87a80f5c21a407a000feb615a0b055dd188477448c44e71df348a0e7b94cc30dc5242e73310315b99fa726018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
0e1db778d27c8b7266529db01f74f56d

SHA1
24311d83708302fac266a1f5a4347bda8f95b948

SHA256
76c3076bd112c14aacd66055bf0c1dcfbdb330b26f7c7c3e4f3124ab75d2042f

SHA512
78b8a82df09997b8a16d08c71fd43bfa31ffd78a9f6236fd6fa478cabca03514c3586604f37627578fd80e355a1e6ada6bcae40ac1d560ba58d90337ae455469

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9a4f9f3b4f6fcdc4cc2cb042e6d2b5b7

SHA1
4109d356250e8e420a69daa6e0dabf70a4a72f37

SHA256
9502b52e07e09b95c1138ddfe1db687ade2ccb24c2ae138c0536d73256ff516a

SHA512
4b564752ad49f7240acdcbc0954999ade6d1e362e22d0084e44c785551e68dd14b2222f75212fe7155b144f51ca185bef322f7e95dabec182c49c910ed04f747

Download Submit