bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Resubmissions

11-07-2024 03:36

240711-d53f4azaqc 1

11-07-2024 03:32

240711-d3s5msyhna 1

Analysis

max time kernel
206s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42.zip
Size

41KB
MD5

1df9a18b18332f153918030b7b516615
SHA1

6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA256

bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
SHA512

6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP

768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-464762018-485119342-1613148473-1000\{0D7F7E5E-3363-4538-B3B7-44E32A37E94F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
4020	msedge.exe
4020	msedge.exe
2444	identity_helper.exe
2444	identity_helper.exe
496	msedge.exe
496	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	644	svchost.exe
Token: SeRestorePrivilege	3848	7zG.exe
Token: 35	3848	7zG.exe
Token: SeSecurityPrivilege	3848	7zG.exe
Token: SeSecurityPrivilege	3848	7zG.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
3848	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4400	4020	msedge.exe	102
PID 4020 wrote to memory of 4400	4020	msedge.exe	102
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 2712	4020	msedge.exe	103
PID 4020 wrote to memory of 3152	4020	msedge.exe	104
PID 4020 wrote to memory of 3152	4020	msedge.exe	104
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105
PID 4020 wrote to memory of 3680	4020	msedge.exe	105

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42.zip
1⤵
PID:3312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbaad046f8,0x7ffbaad04708,0x7ffbaad04718
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16987124588910749485,17543531903792319497,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ZOD-master\ZOD-master\42\" -ad -an -ai#7zMap9124:110:7zEvent17381
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
685547ff51611bf8bc92b10c4b0f053c

SHA1
3410a941ed44ac02d63f935712fd7737db33a6b0

SHA256
929ae83e30bcba0996d87307bb947a815f203fec72e652cbf566501cba5a7973

SHA512
f4c294e5b4e2cef2e0dba19683bb6d56c206d900d3427804e768dd44a1e4c539f673d2e5c95f122e0eef84711743549aa9e629cbfdfd2a9e31d695384be16807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
7d5e1b1b9e9321b9e89504f2c2153b10

SHA1
37847cc4c1d46d16265e0e4659e6b5611d62b935

SHA256
adbd44258f3952a53d9c99303e034d87c5c4f66c5c431910b1823bb3dd0326af

SHA512
6f3dc2c523127a58def4364a56c3daa0b2d532891d06f6432ad89b740ee87eacacfcea6fa62a6785e6b9844d404baee4ea4a73606841769ab2dfc5f0efe40989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
43KB

MD5
3a8e93c58f214d4622af88801ae9bfce

SHA1
22caf6fbb49eeb1697eaf9163b5763f2d62bfabb

SHA256
59ee19c450be3359b056eafc37e00e51a88ac2ccd690f8be043b6c4c185b19f8

SHA512
ee2a7471bb43c0244e07cf1a76031b09fbb39176ec87e07a806608a402aa20567d1a9c5b7a0dc45c9cf7e2c42dc601eaf475b4687bca75245256a6a384c49378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.2MB

MD5
32f58aaf5a515bdbb3d13f72879d2bf0

SHA1
1742585148dcce5d9a85464fdc5b25f394e4736b

SHA256
b2be2096fe98a9b55d92512ae7859e8ba6a54be03afd7eb454b220f9ed888ec8

SHA512
28c693e9a85da7cd7441209c60c4da4b9b6b7da7555c86c2039387b470c453a474a07597069959cccc2840360f76dbb307f88a77e52248adcf8de71ab99cbe19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b5d4af83baca78fdcad204de52c63f24

SHA1
7455782f32aa53774fb5d0bd55d432d1abb644fe

SHA256
d6531e536c3d7bdc1f1ff6e1324055b7dd8f1b58e89a42b8fe8b2fc1b2a2edac

SHA512
41e9244db3e8dba65ce33b47bb6184c49a967757128b1af66e8d4b32fe88065ae702a64f0dbbe1e6b31ef1be02be275daf662621bc952c2300850d7cfd376319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
790B

MD5
637518c32b0896a8b49fbceae34166f3

SHA1
5e2fae2c5223d2bb927c9aa651bc40a6f08261e4

SHA256
86f0d4ebf422162fb77f03f0e52dfff457092eb45ee959de6958b336b5d9a806

SHA512
b9bef08c5c9ac4d8ba029e93da1dee0111f02d434ea548dbd8ed90e8304e0d48369edd20e1af2a3984e0ce31e3a84bbb42f9e01537c827f114d97b6e156bd5e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3258410536ea6316161270cce554b0f6

SHA1
355c4481b126c53b7791ef62c6663560fde4d3f9

SHA256
d68a93b782caad0c693d0c9d5d0f5b6223351d5e0941aebc722e045e9ec91fa9

SHA512
7ebcdfd16d654c5e105a0d8842b4da727fd514e8d8def294c1516218f51c6b9a8807082374e806614428324a47801906d840adcc2578b5f6e2f03e3430168486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
32ea83095e91d4e36d69cc715cd6f2ad

SHA1
5f7abf7ab6230788dd3005a6613597334748e53f

SHA256
a6d3da8a0fa1da81e951d37162ae6e9ec80bc45378bf9c9fd5a5bfba984503e3

SHA512
e87045a69276c6e180eac99cd209fdfcbcc41c009ea47fd10fb4b2cc130020988b17ce0cdcf3acf578f6914e7c823d38617a3b96f5b8c4d73ad1770103c6d79a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a38f61f03096e57b9f70ce7df20a3b5e

SHA1
a0755d9387892872d251197bb22cbd91210cdbb1

SHA256
070734f7212a44e02ab38a5ed0ceabff9cc6f19c8ed297f4fb3ad09a7f7fcfc7

SHA512
77674e5d636bdd13f42c4e8383e8da1d2b95e4e9cf575f3c4af0fa6a77ad615384148e9caf11dc5239a7a97f7961695c09a39635891d85ee290afa1a6bc5b295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e8124066bead8153bed328720e3976a9

SHA1
c9fb4c22a8adba5ab1594e9e9473bfb8d95772a2

SHA256
0e68033541216fabd1505835b29c249c25a42ec6aa4e82a56861c249355f7606

SHA512
116767e612844d860b4ddf21305376c4f7d836ca2099a62cc9baa9a549950083459b2a11d6a609035b227330d7cd547dbfd4538192cb863c0b58a4075a605414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dbf7da77a9b5e19c78c21ee83305504d

SHA1
74b50a0f61f73007130f40c2d0aca37e867798e3

SHA256
86cb444f0c25555986b9acf9c5c0c42a47b31177851a7b0d3421166605530bf6

SHA512
8a10fc8b8cc1905026a4068a2fc8dd1df16188e48eae96ff3efea745b6183364e5ee8a2eb2a0c51d8db1fc3183b873ede38a1dc1445e4faf39c87a6b629a01cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8c68cc633b42c41b614188225e02ab0

SHA1
21f70d1b463bc6cf5edbcbc5df307555a4f75fbd

SHA256
fecfd765aecb508014af875f23e66a28e9c938dce41df25da89aa3e18be484be

SHA512
40e07bbebbc2a9999ba47b7605acd213d50ec2acb6c16b935af6e9e5a77c209ee423e455fb35c2f1edea04d0d6c6c1e0591486bfdbe355c146768b45353b4657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59fa25.TMP

Filesize
370B

MD5
bbf23f89e7d7313b15bf2a95a1f1113b

SHA1
75caff35c39894d15b49fe45fd5ad03a5b14bc72

SHA256
941d5047b6d8b43bf65c353f48cd73bf91fc1a1ed09f2168b1d219cc9b7bd911

SHA512
95bbb96f22b73c307b8e7dc8a35a8ea1e8050db7e09df4be590f2c6a76ed015342f3d21fa6b59a1ad0501c5389e58e53b91a65425cab19443b24b3a32d779e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e760ddef6c437c9c25428b44dd8c6004

SHA1
98bc68a2bc7338da58c13441abd41131c24daf70

SHA256
560d30e0348629ab65aa45243d7fa69d5b1363b3f592838d22946eaf8cc3dbdf

SHA512
9ef790ed12cd307a3b96a649de7c49c1593fd8883d58157fd2b402792e3c793ad958ef8d52e0862864a4168e3d4aba305b8acae7494167addab441ce22e6f1ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
032c59ddbe46fed2a2ec1681540f2696

SHA1
589262d68d9bf060692c5ba777dc51a44f4549f4

SHA256
e2fa02a58dacb5b61acfee588704cf1ca16490897d66e1e20730b87dc830923f

SHA512
9b7fdfdca4e71a96925d3b62544d1a79d8b69ec012e93908994820c1d82fbbd0144f3d72b680419984fff063bc641d5e5d756b53ae1d1c81db3efe1b5e68e8d0

Download Submit
C:\Users\Admin\Downloads\ZOD-master.zip

Filesize
41KB

MD5
ae6438a5a41352e5b7b37918259bea69

SHA1
684f4e642980875422c1e666ee349d9aee5c337f

SHA256
d53a7858a392b314ef7e63d5d8d2f7fa8b6067dc0b9cc926adf219c0c4c0b768

SHA512
28b14be2cadcc3d37afd2a501e553bb5d8df42cb376609c587348a2bfd3eab35e81b76ff2f61b1951a606739834eda607f9dc4334ea60f00bb806edb269c9784

Download Submit
memory/644-41-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-68-0x0000024320E00000-0x0000024320E01000-memory.dmp

Filesize
4KB

Download
memory/644-67-0x0000024320CF0000-0x0000024320CF1000-memory.dmp

Filesize
4KB

Download
memory/644-66-0x0000024320CF0000-0x0000024320CF1000-memory.dmp

Filesize
4KB

Download
memory/644-64-0x0000024320CE0000-0x0000024320CE1000-memory.dmp

Filesize
4KB

Download
memory/644-52-0x0000024320AE0000-0x0000024320AE1000-memory.dmp

Filesize
4KB

Download
memory/644-49-0x0000024320BA0000-0x0000024320BA1000-memory.dmp

Filesize
4KB

Download
memory/644-46-0x0000024320BB0000-0x0000024320BB1000-memory.dmp

Filesize
4KB

Download
memory/644-44-0x0000024320BA0000-0x0000024320BA1000-memory.dmp

Filesize
4KB

Download
memory/644-43-0x0000024320BB0000-0x0000024320BB1000-memory.dmp

Filesize
4KB

Download
memory/644-42-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-16-0x0000024318970000-0x0000024318980000-memory.dmp

Filesize
64KB

Download
memory/644-40-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-39-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-38-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-37-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-36-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-35-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-34-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-33-0x0000024320F90000-0x0000024320F91000-memory.dmp

Filesize
4KB

Download
memory/644-32-0x0000024320F60000-0x0000024320F61000-memory.dmp

Filesize
4KB

Download
memory/644-0-0x0000024318870000-0x0000024318880000-memory.dmp

Filesize
64KB

Download