hxxps://www[.]google[.]com/search?q=arroba&client=opera-gx&hs=7TD&sca_esv=b716066298432941&sca_upv=1&sxsrf=ADLYWIKzBtiBoNDedHJVXLV4LEUJyQA1vw%3A1720524288680&ei=AB6NZqiSKcWpkdUP6qqTwA4&ved=0ahUKEwiokre47JmHAxXFVKQEHWrVBOgQ4dUDCA8&uact=5&oq=arroba&gs_lp=Egxnd3Mtd2l6LXNlcnAiBmFycm9iYTINEAAYgAQYsQMYQxiKBTIIEAAYgAQYsQMyDRAAGIAEGLEDGBQYhwIyBRAuGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgsQABiABBixAxiDATIFEAAYgAQyBRAAGIAESP8NUIUFWNYMcAF4AJABAJgBsgKgAYsGqgEHMC4zLjAuMbgBA8gBAPgBAZgCBaAC9wbCAg4QABiABBiwAxixAxiDAcICERAAGIAEGLADGLEDGIMBGIoFwgINEAAYgAQYsAMYQxiKBcICCBAAGIAEGLADwgIaEC4YgAQYsAMYsQMY0QMYgwEYxwEYyAPYAQHCAhcQLhiABBiwAxixAxiDARjIAxiKBdgBAcICERAuGIAEGLADGLEDGMgD2AEBwgINEC4YsAMYAxjIA9gBAcICGhAuGIAEGLADGLEDGIMBGMcBGMgDGK8B2AEBwgIKEAAYgAQYQxiKBcICEBAuGIAEGNEDGEMYxwEYigXCAgoQLhiABBhDGIoFwgITEAAYgAQYsQMYQxiDARjJAxiKBcICCxAAGIAEGJIDGIoFwgINEC4YgAQYsQMYQxiKBcICCBAuGIAEGLEDwgILEC4YgAQYxwEYrwGYAwCIBgGQBhS6BgYIARABGAiSBwcxLjIuMS4xoAeoPA&sclient=gws-wiz-serp

Analysis

max time kernel
2640s
max time network
2646s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/search?q=arroba&client=opera-gx&hs=7TD&sca_esv=b716066298432941&sca_upv=1&sxsrf=ADLYWIKzBtiBoNDedHJVXLV4LEUJyQA1vw%3A1720524288680&ei=AB6NZqiSKcWpkdUP6qqTwA4&ved=0ahUKEwiokre47JmHAxXFVKQEHWrVBOgQ4dUDCA8&uact=5&oq=arroba&gs_lp=Egxnd3Mtd2l6LXNlcnAiBmFycm9iYTINEAAYgAQYsQMYQxiKBTIIEAAYgAQYsQMyDRAAGIAEGLEDGBQYhwIyBRAuGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgsQABiABBixAxiDATIFEAAYgAQyBRAAGIAESP8NUIUFWNYMcAF4AJABAJgBsgKgAYsGqgEHMC4zLjAuMbgBA8gBAPgBAZgCBaAC9wbCAg4QABiABBiwAxixAxiDAcICERAAGIAEGLADGLEDGIMBGIoFwgINEAAYgAQYsAMYQxiKBcICCBAAGIAEGLADwgIaEC4YgAQYsAMYsQMY0QMYgwEYxwEYyAPYAQHCAhcQLhiABBiwAxixAxiDARjIAxiKBdgBAcICERAuGIAEGLADGLEDGMgD2AEBwgINEC4YsAMYAxjIA9gBAcICGhAuGIAEGLADGLEDGIMBGMcBGMgDGK8B2AEBwgIKEAAYgAQYQxiKBcICEBAuGIAEGNEDGEMYxwEYigXCAgoQLhiABBhDGIoFwgITEAAYgAQYsQMYQxiDARjJAxiKBcICCxAAGIAEGJIDGIoFwgINEC4YgAQYsQMYQxiKBcICCBAuGIAEGLEDwgILEC4YgAQYxwEYrwGYAwCIBgGQBhS6BgYIARABGAiSBwcxLjIuMS4xoAeoPA&sclient=gws-wiz-serp

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-40-10-da-63-d4	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-40-10-da-63-d4\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-40-10-da-63-d4\WpadDecisionTime = 13a2780cfed1da01	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-40-10-da-63-d4\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
2936	msedge.exe
2936	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4416	svchost.exe
Token: SeCreatePagefilePrivilege	4416	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3032	2936	msedge.exe	81
PID 2936 wrote to memory of 3032	2936	msedge.exe	81
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4536	2936	msedge.exe	84
PID 2936 wrote to memory of 4320	2936	msedge.exe	85
PID 2936 wrote to memory of 4320	2936	msedge.exe	85
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86
PID 2936 wrote to memory of 3268	2936	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=arroba&client=opera-gx&hs=7TD&sca_esv=b716066298432941&sca_upv=1&sxsrf=ADLYWIKzBtiBoNDedHJVXLV4LEUJyQA1vw%3A1720524288680&ei=AB6NZqiSKcWpkdUP6qqTwA4&ved=0ahUKEwiokre47JmHAxXFVKQEHWrVBOgQ4dUDCA8&uact=5&oq=arroba&gs_lp=Egxnd3Mtd2l6LXNlcnAiBmFycm9iYTINEAAYgAQYsQMYQxiKBTIIEAAYgAQYsQMyDRAAGIAEGLEDGBQYhwIyBRAuGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgsQABiABBixAxiDATIFEAAYgAQyBRAAGIAESP8NUIUFWNYMcAF4AJABAJgBsgKgAYsGqgEHMC4zLjAuMbgBA8gBAPgBAZgCBaAC9wbCAg4QABiABBiwAxixAxiDAcICERAAGIAEGLADGLEDGIMBGIoFwgINEAAYgAQYsAMYQxiKBcICCBAAGIAEGLADwgIaEC4YgAQYsAMYsQMY0QMYgwEYxwEYyAPYAQHCAhcQLhiABBiwAxixAxiDARjIAxiKBdgBAcICERAuGIAEGLADGLEDGMgD2AEBwgINEC4YsAMYAxjIA9gBAcICGhAuGIAEGLADGLEDGIMBGMcBGMgDGK8B2AEBwgIKEAAYgAQYQxiKBcICEBAuGIAEGNEDGEMYxwEYigXCAgoQLhiABBhDGIoFwgITEAAYgAQYsQMYQxiDARjJAxiKBcICCxAAGIAEGJIDGIoFwgINEC4YgAQYsQMYQxiKBcICCBAuGIAEGLEDwgILEC4YgAQYxwEYrwGYAwCIBgGQBhS6BgYIARABGAiSBwcxLjIuMS4xoAeoPA&sclient=gws-wiz-serp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9fd846f8,0x7ffb9fd84708,0x7ffb9fd84718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12048414368640505992,4589873174906556389,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
97f8be9c465b0ed67c2415868506c354

SHA1
cdb221d6debcf55615d3b5f30796e32065046dd9

SHA256
b606a1ee10b65eb9077e7d2f3b34a0d7a1ed6a4802a169fe55449c975332ee02

SHA512
a0fe0ed30624658127316873137f4fc488a5916005e5e3f1f55b7d6442b54010c08d7037b94d0cf3c3316b1bb4acf91bad9e64ee6d15302e3cdd62bb18730542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6ae84fc1e66cbbb7e9d28b0e12d64550

SHA1
100430bb653c896c11b94ac0bf2297a389ea5ad8

SHA256
856a9c0ac8c29f738a3501b6bd007fd8cbbac211e461b91f4caff52dd41da75c

SHA512
7fe7a8639d96118b843e67a6a6d397271b181dc6b049e6f7de77bee9c9214690b1b7f73164f7e463e117406dc978334ea02397fd639140598f60f89c6aaddbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7a15e4752829a7ef531e4ca37e82e3cb

SHA1
0537b1907b7e864ed2d8a9aa763f9a94ea81ea25

SHA256
c90b8152e892260ce1b0d8059675284b32ef6393c8aa1ce063aa05d5644d5701

SHA512
a46e67d85e42f3942b806801deca654a65b6f4b316d5a2756b9f6a9798878673b23826775275ec411a3639026dcfc2380c4f44dcab00eba43bd725719ff54d9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e85376fa3c2fbee26a46365293a0411f

SHA1
4c4339acf2666858d2863991411cd5b3cb9be80d

SHA256
a424e97ab55f40cc8e0547608b364b69d898f511f103e99deeed96d7f66d0932

SHA512
0de4c42885814f5ec694fd1b08ebaeb82cc13140f2773995160f88870b85603616325223e637a6d4381774cd05d3a89cc451d21dc2945d32b7a4221ebac6bca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
b08bf5ba40d7e4361d7e30cca4845626

SHA1
64cf14fee14ebcaf85591e3c5de18eb1b33e341c

SHA256
0aa3aae184e30cd0ee08138a2002451f0a665e3f466c77fab1ca71c505607271

SHA512
657e87f1fd223701fcffff1ccdb950b9166b53e07ac0350de96f4cbd3f8ec09dacd99b90401f098a8609e0ba378d7edd58d900478760b15af21391423c2303d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
871de7e2b2f5396ba7c5ac51e9c4c506

SHA1
5d8ea5ab174a701e93a3d1047b508ac472121168

SHA256
03b88064d8c02f60eebae4a510f3f6a8ae97eca703ceb0fd8b8d3c0f36f2e699

SHA512
6c0354045466a41c2d766242974b35452fcd667c9c29b69819a2db4775520d8c27a2f23407c846458810ea17e2846358d1352d14d526b52b857716aab20c3058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6c3514f027feb83b26ccca7356ab1570

SHA1
f766e480aca5e63ae7e924ceaa6136a5ba8b3cf9

SHA256
41e5234513fda7316222ecf090af82530bd1245e63d73891a94316ba24085839

SHA512
e57ae434c361eabb7e6fbcfa6f2fb950a1e9527b3f7ed59d13823fb3811f5490b4d6247e92ef3a62bf6108283dd3e80e2e0c2efffcbb63fde981b495584e59fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b552673dd6ba831ad17f69abd3c8ceb8

SHA1
526093c56ebd0b19fad1cfd4073ab9d23d99c934

SHA256
4f34f3ef7816775abd3137908603d1ce8c05a97cca7de4814885a4e1f009b203

SHA512
2a7887e151460226225535feaa340f2e7c2810a8d28c174d2dcf066c895bb780a651813423714cdba723e1de6bee0d54c9eda05a6890bcc5807975c9e99297c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3583ff8ba84b11f2b08ade53b36a63ef

SHA1
2c471b345441ac176e1f5731f395a8ddbce3d6f7

SHA256
5bcd37e9e0c3d1df5660957a5f62f1e729207592bd00f3f8761e412d4ea52972

SHA512
f57e271badc20fa4ddbc2006370ab17ce191bbede0dccc45cd1b7c5f01c3b4d26cf1843718ea23f3d6732c933d6bca1565bd43ff39309a560ed473a5d7a9184a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2adf2f35797ac0946c418817ea3a79e3

SHA1
260382cf6267dfec29e95954eb1d80b5230d70e1

SHA256
063c02100ee3fc6713c2e1d615f273ce5cbdefc241e87cf44a462ddae26191cf

SHA512
729785d60b67088a83bf3ead09f387806cbd37a4b0d6cf843ff76348e1620cb17d86fd343f60e77ebda9901bd23d43c382fe2e977cc4e8596fcaec4b65f86869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2eca719dc95611875b980708bbfa330d

SHA1
8ce6de97746d4a908af0cbaa7a8ad125ac56f694

SHA256
8492663bc5da06bb18340d049a181b6edfbb337d607935fa86cfec927305826d

SHA512
0df92b719fa4408154c999dbd7ac78d1c2c034258983468dd7c871eb692e2d32b438087bee2c9684d2513e4be3f81468876c1c3c4efdaa6cdcd996cb3330cedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e0f8ec65d63e6b700ebf8493c95d632

SHA1
a2067638c54686e70d3a995f0414a777c122ef5c

SHA256
38f6b4713ba5d416fd7a58b2d5591074ae05aca45e297bfbf29f1842eea629d0

SHA512
633ea32530ee79fbe2ccf0f3949a72dc2b7d5f25c833b5c5d8de13ace663921221077828f9f9af0edf76a46f0839c7279174234e2c55f6b1649e53e3452326fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
ae5f0958e175b79c8481ebe002c83df2

SHA1
f8b9ea16e23f30eb276ac420ea97bfbcfe2f4f1f

SHA256
e458683889322baa2e6a0c424bb83d794f27ba6eab2c84628dbbbe504f6891c9

SHA512
99bc75bebe793d6d88e44a8aa3d5d73f6e8759f674e5b3fc4933287378389fad08a9b949ad1f396d18ec0b15bc65a1bb97f51b925425bdc44598c39effee34e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
202B

MD5
72bdfa222c5fc9a0d6360f9b7f6f9d68

SHA1
2fce3a45e6116196cdba6457492bafdab0e5688e

SHA256
71698aa64bfc360f6dd6141f0b4ea60bc23343238e37f020dbebadd291e67abb

SHA512
fc908c2d0789f6a7a552dcc2ce2fb2a447ab946a0ae98b760f3023a92a8fa234b802f7d67a568621b247da53e38eab44a2a5d3c8ce6570e333558e701ed69bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
202B

MD5
bb6abe5450d4a3e50032025e6ba20481

SHA1
98e95bc4a016774ef890247fa96fc74d5a71c639

SHA256
ee84210529e69850079bae5b5f6f14f62e315383e274034f75b272f690bd1558

SHA512
1fefb79e3c34ab26186251fb5253b0a5a3a15c4f134f22da083eabf4d3ee2dd6dabcf4275364c4aff75df126d094b4aa880f1d73739525f2d811573433abc616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c8d9.TMP

Filesize
204B

MD5
acf05bc7a3f8b85431c5bbcadffce092

SHA1
276fa6d9e1f4ade5781fa580a3ad5cbfd661f357

SHA256
a6c6d9dc5c69025a02c0522ac170636460fa5f9cb1bd864c21fda6e6196d1eb3

SHA512
5cca35241c3af55b14a373b467044df800cc27937376ebb53d78babfbf51d380c601b0a6dd35ea1003af50b8465229f9a4141bc0b2ae9df246468f9e6ca47f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4d8d17d2655597bb518bda781f25cb7

SHA1
42f180735a4eb6db6fd67457940ecc7c9d25c8c2

SHA256
283a7ee05c0a7443e10c0d83fec9e528d52d691e6b52bbf3d600456fd5d30751

SHA512
927cbdbb706e9953559ca50a039e590bf7f6125ef04f0481717a736ae3ddf4ce184cd9a193350344d43ebf322181539844761c5e61cf60f820fa6e417ae70412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
81acd1114b467f732f5986a0ff2184af

SHA1
390810f4e179584287f319aa29fd07d77f6d19d6

SHA256
79e66cfd6d9c4b876ec298578604e98a4f0304841379f8d74f8db89c1bbd0241

SHA512
b231c823a72fbad05c95462ee656c80516ece3c4f977b69f1126f2d9cb18caa8316e8a9f1fe6f6ded130c18d09a7e48a9b805c6a6b9900870319ccd5186e75d0

Download Submit