hxxps://workupload[.]com/file/mFAvy2D7yEA

Analysis

max time kernel
107s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://workupload.com/file/mFAvy2D7yEA

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5820	default browser.exe
5944	default browser.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5820	default browser.exe
5944	default browser.exe
5820	default browser.exe
5944	default browser.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 723265.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
2464	msedge.exe
2464	msedge.exe
2000	identity_helper.exe
2000	identity_helper.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5720	msedge.exe
5720	msedge.exe
5820	default browser.exe
5820	default browser.exe
5944	default browser.exe
5944	default browser.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5284	taskmgr.exe
Token: SeSystemProfilePrivilege	5284	taskmgr.exe
Token: SeCreateGlobalPrivilege	5284	taskmgr.exe
Token: 33	5284	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5284	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
2464	msedge.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe
5284	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5820	default browser.exe
5944	default browser.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 3232	2464	msedge.exe	81
PID 2464 wrote to memory of 3232	2464	msedge.exe	81
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 4792	2464	msedge.exe	83
PID 2464 wrote to memory of 1480	2464	msedge.exe	84
PID 2464 wrote to memory of 1480	2464	msedge.exe	84
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85
PID 2464 wrote to memory of 3352	2464	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/mFAvy2D7yEA
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb42ab46f8,0x7ffb42ab4708,0x7ffb42ab4718
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,12760625052055936835,17678318555406969352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Users\Admin\Downloads\default browser.exe
  "C:\Users\Admin\Downloads\default browser.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5820
- C:\Users\Admin\Downloads\default browser.exe
  "C:\Users\Admin\Downloads\default browser.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b6c11a2e74ef272858b9bcac8f5ebf97

SHA1
2a06945314ebaa78f3ede1ff2b79f7357c3cb36b

SHA256
f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777

SHA512
d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9abb787f6c5a61faf4408f694e89b50e

SHA1
914247144868a2ff909207305255ab9bbca33d7e

SHA256
ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07

SHA512
0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
37KB

MD5
27eec7e8f48ac0d64e62ec535a19ed37

SHA1
0454ae16951154ff4d64dc2dd20f780b6da87ee8

SHA256
9107d29b79f5c0e9d7ac88f893e0afb7c672d536b2e41de469172c8b7366e3d0

SHA512
f93033661c1974d9225b7e05543d7efe62574567abf7bdbb982b36e5b0be658937a7128de10376f9e39c20a2d40688862fa0e76aa53b0b8c87b99ee536fbb175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
0672b743adc6cd9724831e45690d86ab

SHA1
ada0ecaee8f9683c280384a95af7ed0c13b4718c

SHA256
7a5f31939a132fec37df66b90fff731e7764f6788f2cf25c63aa653b1c2c4219

SHA512
48133ff8ababf57632b9da75d4402fb3616f9de64d5461eceaf1b27c65278445de604312c495d921de7cb3b885eff8304bff4803527e4777b47915dcbd9df1d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c6e40a3b0095addba044dc3b48eefc67

SHA1
c5b5f655ee99ccbf295c03cc31a372a304d71064

SHA256
3ce474b274b7bc33210b622cb2febe95e7ba949bea752a5c1db99343623585ae

SHA512
c3c89b7e1d70b5de7c3c0ac7b37e2554b71d993c4bc695d12594a4ad49c2f09f56ed26414bb78e4414e96d195f4fa9c5d4fd777608682194412df6c2ccdbfdb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
9068670aa9d1b5e5a614cd83372de194

SHA1
7f6794be67562f03c99c120ade59695463237510

SHA256
483bf9a6d4c5bf3b06ffc8706634e047cbb37c0e49c4eb543d2fcb5b93e4c827

SHA512
9d9b660585102ee03c05d15fd985dfc3b751122b05a42647b0f06893419103448612ee6b5cacb4469480540ac129e2aef2d60bddf48aa2e6c01f5735fdc96721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a532d8d7edeaaef0c1e7785b7e96240a

SHA1
96939cbdd4d0eeef70b35dbc77604fe9264799ee

SHA256
ef439eeb01cf89db1fcc40766d434ac04059c4bc608daf807c8c239326f58012

SHA512
f5200306d37c30b5ef9c16a523914eb4c65f486550c996cab2b0b11929080571d1461cd49e65f18d95f5a7f767b65ccb8befdd0c799ba3b3530f1573c8418d96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ad37de81eeecbe913f0d4e5199034401

SHA1
ba44bb4f4e8481a85b02adb33b6ed4c7aa870dc1

SHA256
086ca57c115aaefe673a508f5b0880dd28ac607381db302c53ef0de38c376a05

SHA512
35a4c3b03d8233c2dbb92174b525e8d21e3a64e6ee15fc28405ea28ed05a9e7140650e1da6876498e7c51bf458a323fe39d10c158b19649b346cc9a8c000961a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15d3acd8f5056b70ae25c9e548f5e206

SHA1
692264e3e5161b70ac2aa97382c27c80f89dcd96

SHA256
b70177477dca1b04fcf78fde2fd159809836379bfe815150f89325895e677bc3

SHA512
2ba90604ad957b02b144a6544189373e51b65b2b49948db075b29dc4a4486f9b9d9d4ce8e4f76daf5a792b818c0f9d7593a54462b86a85122c98bcad0ae039ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7934db2bc463820dfbe2d781fbcdec0a

SHA1
42f06fbfcf091e5ca7cd0aeff156cf76b4f3f44f

SHA256
d271e7a1f6c74fcc63ebf02cba6ceafb60cabfb506f394d9bc3cd10ebdfc6cde

SHA512
835ebfa8b65d13fd0632b9cc98d467f131929dc3663c60785f7f9cfc90895733387b0a9716742fa6b75e76be58f19552b9b7091ae598ac9d9795524ff8c5e081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
230e179c754518b4ef966a0fa13f6dae

SHA1
b97326690c23c5ef7c7c82335e6772bbf7e80877

SHA256
1a60174bc6604da0715f0e470ecad60f0b2c5701ca91d5cedc340a9d1b26d9c5

SHA512
7b54dadbfcb5fb1393601ce5cf9e0bd6c790ff817d37dda5e5eeff04a17acdc7a67ab0cbdc37d8afd41ceefdf7093fcaf2ada5428623d50ae3e1a1b318d38210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
46e02e34af92354b64ed4c69785b1dc4

SHA1
00a5a4bc676f5d173a5f023418d5fb8413ad1b8f

SHA256
22d5cd1d1eb833a089cb6570de3e9be7a105e5471607d212fff37eb3f64875c0

SHA512
9c0739073617d9399a24711c36f2d905b36b4393cbdb84ad11d1a9090b1bd4c966d83294880294c971bbae1e30916d228437cb1905965cdee7757abdb5ae863f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
58699d4552eb29603d35c5d1ddd77b0c

SHA1
f83951067d5b17de23eff29f6b3e76536ed58645

SHA256
f9d46e33d0c6947b98467398a4524f06fe1b396aa483bb9534cf46651ac5d840

SHA512
a77b04d32656a88cc09dfb1a4a2ba4e1ee57f4e07145ee8323adc4bd825c7c8059b85340000d50bff657a50e991426ddf991a2ce74f1100447b14f64e4917923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585afc.TMP

Filesize
204B

MD5
899e8428f90b5b47835c9559c69b3561

SHA1
547a0377afcca1480ae225bfa9178b6b39cdc97e

SHA256
6f3a687ab429325aee5d5e8472f07f2d92fa1b2906ee73e5e4bcfe68a8f18181

SHA512
974d1a04d5fad55c8fd77a4ef4de9f593efa8783b2fd3506fd40df7e03ce3cabce4290ec4b86ac4de949caecedda8d39942eba476586ef3b6b7a484c32cf24e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
342063e53d2cf280e09af80a49459a07

SHA1
d494081faea147dd55d2a1ed7297e67f8a2fc316

SHA256
f968ca41c4fce591181980b95298dafd0b8fea7f07cd7a72e01c95f156f6ffdc

SHA512
387edbe453d6fb1356ccdbfdbb66019313e93c62a366d31b0e4c1b31afba968d62c99c3cac40cb9eb02d75f111537019987f37fe7110996a7289ee2364a7d461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a9ccc71d946eec68307993e50423487a

SHA1
69a3c6412f51f9e87ba21866f11cda096f7635d2

SHA256
c05aa6eea9dfa2d9fbcc7b4fa4e7add833f3f5e634c5a0750426d9a585deda61

SHA512
8f760f9c9eb0337d76c8a846cb04a37a9c30137ca5b098c82777f6a22ab850b9e0f096f657095b85aa2d38d3df37eea54559bb065de155a54f1416f1d705e9c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f674be7afe3f9bb4ebb709696950bf6

SHA1
1afc8e6480c0aad904ec1701eb044983fe8f87d4

SHA256
425cca65db4b20c8559a7370279a5a9108a359755f489c100d9900d2cfe70c9c

SHA512
044413e432988685e3c48798537ab8d291d026116a0d6a69a69230978db6509f15cede848f26efdc2455010d3f3bd2e13d4c5638c60f36ff5569bb0843dc3177

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 723265.crdownload

Filesize
11.6MB

MD5
49c89f5429d47efdae5b868be75b3090

SHA1
c678f2d5074b68327c8934375fd6073bddf4ea12

SHA256
04ec1f894dfdb8190c12136f8e2b47c6c747a5a82c2ddee156f9a88f6803cc01

SHA512
8298ef67dbb1a4c6ae53fbba183ecabae8e5c6eaaa7998ab7bb99f3ddc6d572bf8ff3a3a293fe5dc4298451c5cac8fb863ec9e80d27346edd8a51f824db879a5

Download Submit
memory/5284-381-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-387-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-391-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-390-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-389-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-388-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-393-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-392-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-383-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5284-382-0x0000023750590000-0x0000023750591000-memory.dmp

Filesize
4KB

Download
memory/5820-439-0x00007FFB50EB0000-0x00007FFB50EB2000-memory.dmp

Filesize
8KB

Download
memory/5820-441-0x0000000140000000-0x0000000141373000-memory.dmp

Filesize
19.4MB

Download
memory/5820-440-0x00007FFB50EC0000-0x00007FFB50EC2000-memory.dmp

Filesize
8KB

Download
memory/5944-446-0x0000000140000000-0x0000000141373000-memory.dmp

Filesize
19.4MB

Download