Resubmissions
04-07-2024 11:28
240704-nlal3sycra 1003-07-2024 20:16
240703-y2dnsaxflh 303-07-2024 20:08
240703-ywwmeawbnp 1003-07-2024 20:07
240703-ywad6sxdqg 303-07-2024 20:02
240703-ysff1swakk 603-07-2024 20:02
240703-yr5draxcng 303-07-2024 20:01
240703-yryk7sxcna 303-07-2024 19:57
240703-ypp62sxbne 303-07-2024 19:55
240703-ynf7ravgnn 3Analysis
-
max time kernel
36s -
max time network
39s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-07-2024 20:07
Static task
static1
Behavioral task
behavioral1
Sample
AutoDox.exe
Resource
win11-20240508-en
General
-
Target
AutoDox.exe
-
Size
81KB
-
MD5
ec51cfbde4a4df4eceb8313adf8d93ca
-
SHA1
f8925a067c34ab1b0e7da2de961af20247ace3fa
-
SHA256
aef13f3ec8abf777929e42aa3de86774ab8362f7fbfcc0475c7b912ce253c002
-
SHA512
1cc6c73c33ce6d00c102f9ed3c6733c532f131b00761fd4ff59cda87c560e3ce3e06dfcbb8a886976ae5084c9d36c3f02d9afefca5b1403c20b53735fe24bada
-
SSDEEP
1536:9rsgf4VFHlI++UIoyjyCL6sf+Fle8Ifvl1loJbh76e:ClI++UIZIsf+Fle8Ift1loJbh76
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645108811489972" chrome.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
chrome.exemsedge.exemsedge.exemsedge.exeidentity_helper.exepid process 2336 chrome.exe 2336 chrome.exe 964 msedge.exe 964 msedge.exe 4508 msedge.exe 4508 msedge.exe 4828 msedge.exe 4828 msedge.exe 3228 identity_helper.exe 3228 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
Processes:
chrome.exemsedge.exepid process 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 2336 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe Token: SeShutdownPrivilege 2336 chrome.exe Token: SeCreatePagefilePrivilege 2336 chrome.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
Processes:
chrome.exemsedge.exepid process 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 2336 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exemsedge.exepid process 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 2336 chrome.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe 4508 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2336 wrote to memory of 3196 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3196 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 3504 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4916 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4916 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe PID 2336 wrote to memory of 4688 2336 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoDox.exe"C:\Users\Admin\AppData\Local\Temp\AutoDox.exe"1⤵PID:2088
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffd12f5ab58,0x7ffd12f5ab68,0x7ffd12f5ab782⤵PID:3196
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:22⤵PID:3504
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:82⤵PID:4916
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:82⤵PID:4688
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:12⤵PID:4448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3152 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:12⤵PID:2812
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4204 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:12⤵PID:348
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:82⤵PID:676
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:82⤵PID:404
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:2860
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x250,0x254,0x258,0x234,0x25c,0x7ff63dbcae48,0x7ff63dbcae58,0x7ff63dbcae683⤵PID:2800
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4568 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:12⤵PID:5060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4376 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:12⤵PID:2424
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3372 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:12⤵PID:2784
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:82⤵PID:2588
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:82⤵PID:2716
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:82⤵PID:4072
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5040 --field-trial-handle=1808,i,15400465544514342865,4871201937438554114,131072 /prefetch:12⤵PID:2152
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:5044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd23643cb8,0x7ffd23643cc8,0x7ffd23643cd82⤵PID:4680
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:760
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:4864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3148
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:5032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:2152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4828 -
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:12⤵PID:3148
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:12⤵PID:2036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7117065452844326138,10957320757432200206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:12⤵PID:1556
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5e6fe6e0-8b6b-4305-aa67-eb3a44f51345.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
810B
MD5376b1723d890a70a6503d3413b1fc866
SHA1e764b5e9a35feb7c32510d751cdf6b92835c62e8
SHA256fcff8ae375c330fbb23897dfa5c81f13f9f0bdf4d21aed36c5d296ac34826bb7
SHA512e96f98dc296766a1b9fb0fb44bad2eab66974113cbd241b40f5692cb6e3c6f04a53ac358bfe0f0fd130e819eacdb73eb4ec8a3db202063ce02da8a67a5bc7d4c
-
Filesize
7KB
MD5b5bdb6d911b23bd52a0db4a4688b498b
SHA1b6cfc94e5566bfd1cc4da70b043c99add506725c
SHA256df8dfbd8b7f9a0f5c9e7d54216bace129c070e29abc1b9b4c7685e52d81f8ffb
SHA512d9b177bb56ef48900cad9d156140988e16f035a71ef0d71bf69ea023aaf1c75adc641421c80ae30583ea66cff5334c37ade73012a88471fd3def8b9084e46512
-
Filesize
7KB
MD51b80011605a225834747328172376cae
SHA14ab94b52bc2e9738420b39811262a7abbbd5e8c2
SHA25682387e097e2c4939cb131e93f77b76646dab09f4997e1c8c27dd4c171b95ff6f
SHA512506e0c0cf5adf25bd265b210edafd8d753f9cf80b6bd38d267a8b4e6b2fd1f1d0ca8d0b2c4980589c8355ab18361d3df5123f4ab6239cd8681665a3dbefee6f3
-
Filesize
257KB
MD571f15b257b7e30783812c01d2b0e8f0a
SHA1a3c12252afe25b21833c86a8a8aeccb6d567e2f9
SHA2561280d184d5515e64b186d4a5dab694979fdaf80c255377cd085cac4f059d02f5
SHA5125fa6fc513080b3c05e39c31f81bd3ceb6138c119b359e7e58a33b64e4e4128d8bdee7ae552791a264fcfebf6e1efe3c1dd77a804cb0d230c8190a342aae70efb
-
Filesize
257KB
MD5b094d66dfd8092ff200997913a00542a
SHA1f1bb45d7f5cd221232cd8029f9a6efd287027c97
SHA256102094aa84879820f5bb58339b7c87758672dbdf7226adfa10e37ce1b1c8eca1
SHA51279198e962f36ff66b09a72bc67f6a5d3d9a3f9b61633ddd4a4278d54487a690518ad5d65d3e8d65e7faf0b8bc459413aea1f3759e636434f2563adb793de0626
-
Filesize
257KB
MD5248fcce1b2a06ce9bab499d020f03e47
SHA15da76aed4032cf60bcfd0a2ed51591e00504b662
SHA256a4f9efb3491d86e43b876f5affe0fcb91615c8f595ad30eb2bf0e964337709d4
SHA512d6b6b5a7a0a0e0b7b99e94126168c567cb12213e5ad274b0bda38c162e5af5ca1580cc54f4f9eaf06cda85c3e3e55334ba5ebaa785e6ef985d198b9733e3e14a
-
Filesize
152B
MD58f2eb94e31cadfb6eb07e6bbe61ef7ae
SHA13f42b0d5a90408689e7f7941f8db72a67d5a2eab
SHA256d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de
SHA5129f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703
-
Filesize
152B
MD5d56e8f308a28ac4183257a7950ab5c89
SHA1044969c58cef041a073c2d132fa66ccc1ee553fe
SHA2560bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae
SHA512fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189
-
Filesize
5KB
MD5c7749a3c7829c2e4b71d97d5ece46cd5
SHA14df09252ff66a68ed2d1c09834570f61414355cf
SHA2568d551c069aac94a90de6c16b51fc979aaebada6e2c6bf5be23e2332374e46d12
SHA5125e8a961312e95336891896bac389676f8e348612598af52a892e452254b78087d133db2c358d28c5946d52bca50792a1574eca38641bcf73e69b814852250d14
-
Filesize
5KB
MD5e827c356b675ca09e2f81a02dda8e601
SHA160dfdea1f0a8c82d7508847f9bcd6700c96165fa
SHA2569b2778a0da9c6dc3814e2befca7181ff61e1368513fd3814613c8ac695b9c869
SHA5124efa90e2169505dc451e60a81e1c025d691ee1e0b1617e48b0308d2333ca5dbdb7fbdcb53d0d45df83b5adabe26c4a2820e826c2408fbff6fc185e7039d6c5b5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD522c924822a179211bb3dc5daa9af7e67
SHA1728fac19442b5e614634d136f335239c4e69f64b
SHA2561e0018c5ba32e275759504b8119ee1fcc655d24423e7d34134e7af475436ace4
SHA512f0c18c7210a8d84c79cceaad1840bd57d96cd141e66ace37f3195871331f7945b98c486f376034f4121c91b1770bf7c8da8e48a8c2f951813db4f58fcc65b52c
-
Filesize
8KB
MD5813184c2937c5bbb69226efeb1d72b78
SHA1bb8f229d53586e725b2acc04cfcd248c3ce3965e
SHA25614f7eb39af37cf8d3e11af0a498f59921b571c87ad0cd2df1249eda39d47d98b
SHA5122cadb14b33ae82195aa204305545609a1ea23d50ffd67812f9f7b4cd7d1b3c0f6a48fe211ea94102b217ffc325882915bfe3a7f1b1abb915914017bc75e1da04
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e