hxxps://download1334[.]mediafire[.]com/ki60lhaeitag7ESvpZLEihN5C9xlDQ7fj1yUis3pSR_bPg7oMloKLCzqga3NhvOROUrzJSbdWgHU2NAGL7aJgwwq1H0y1aGWWFkwKh28WcIyoqYGD6Yjb5r7m6RQMg6RlGVUQwKFAjeppPpz2a1kiDvyqty6Ia9nfnXldaTWdOo4UQ/efg3srmgimv4o9r/Global%D0%A1h%D0%B5%D0%B0ts[.]zip

Resubmissions

01/08/2024, 21:57

240801-1vc5saxhqj 7

01/08/2024, 21:52

240801-1rgnssscla 8

Analysis

max time kernel
223s
max time network
215s
platform
windows11-21h2_x64
resource
win11-20240730-en
resource tags

arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
submitted
01/08/2024, 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download1334.mediafire.com/ki60lhaeitag7ESvpZLEihN5C9xlDQ7fj1yUis3pSR_bPg7oMloKLCzqga3NhvOROUrzJSbdWgHU2NAGL7aJgwwq1H0y1aGWWFkwKh28WcIyoqYGD6Yjb5r7m6RQMg6RlGVUQwKFAjeppPpz2a1kiDvyqty6Ia9nfnXldaTWdOo4UQ/efg3srmgimv4o9r/Global%D0%A1h%D0%B5%D0%B0ts.zip

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4552	winrar-x64-701.exe
2752	winrar-x64-701.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-25141632-2315680713-2621025411-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-25141632-2315680713-2621025411-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-25141632-2315680713-2621025411-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-25141632-2315680713-2621025411-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-25141632-2315680713-2621025411-1000\{B8F53542-1273-40C8-B555-60A75CDC3508}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-25141632-2315680713-2621025411-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\GlobalСhеаts.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 501853.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4080	msedge.exe
4080	msedge.exe
1488	msedge.exe
1488	msedge.exe
4088	identity_helper.exe
4088	identity_helper.exe
3984	msedge.exe
3984	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
1820	msedge.exe
1820	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1432	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1460	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
3460	OpenWith.exe
4552	winrar-x64-701.exe
4552	winrar-x64-701.exe
4552	winrar-x64-701.exe
2752	winrar-x64-701.exe
2752	winrar-x64-701.exe
2752	winrar-x64-701.exe
4228	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 640	4080	msedge.exe	81
PID 4080 wrote to memory of 640	4080	msedge.exe	81
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 1740	4080	msedge.exe	83
PID 4080 wrote to memory of 4872	4080	msedge.exe	84
PID 4080 wrote to memory of 4872	4080	msedge.exe	84
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85
PID 4080 wrote to memory of 2608	4080	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download1334.mediafire.com/ki60lhaeitag7ESvpZLEihN5C9xlDQ7fj1yUis3pSR_bPg7oMloKLCzqga3NhvOROUrzJSbdWgHU2NAGL7aJgwwq1H0y1aGWWFkwKh28WcIyoqYGD6Yjb5r7m6RQMg6RlGVUQwKFAjeppPpz2a1kiDvyqty6Ia9nfnXldaTWdOo4UQ/efg3srmgimv4o9r/Global%D0%A1h%D0%B5%D0%B0ts.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xe8,0x104,0x108,0xdc,0x10c,0x7fffc0ab3cb8,0x7fffc0ab3cc8,0x7fffc0ab3cd8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,8495811863659837209,12247779208319361601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:764
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\433f533af5c643eeb5e34ae13437f217 /t 4692 /p 4552
1⤵
PID:1000

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d4e9e55f2f334f7499c579c65a45b1b5 /t 200 /p 2752
1⤵
PID:2924

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0ce5d292e9dab802a3c25f387277f3e3

SHA1
afeab24faf943fdc8a89b2ec0b427cb4d38c87cc

SHA256
011c29b70b474f741b42164aaa91d7986b4a1e817e8921f4b369dddf5a2f6cb9

SHA512
86a887988c29adf4142248557cb98a6bf7867eaf3bfec8119f5bd52146ce1b1bfae39967dad757da4fc3a50ce198d170078c87958269e24e46db58c842eeb775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
63cb45e3f96b8c6c1ba49b00b759d0c9

SHA1
834d5b6a3499947e31278c13a296c950e19b2f9a

SHA256
9b7241b1a66ebbe196c1c3c8349d8076cf10909619807558d058509809ef81f6

SHA512
8c0c03e5a2bc77e3c38246acf43ede102d3094d43607959c2762c6b96fd199d89144e2eddc01a03e9d337d2c125a87aeb8367ef023757c2f2a57f9d23fe29ee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\142ff1c6-ffc7-4092-8a2d-144a5778a2c6.tmp

Filesize
703B

MD5
6960cc00b715eaa63da77a1ff1084343

SHA1
074a21490f6e66eca85cdaa251bf0f1f14a708de

SHA256
af898eeb7c7ba09e0782205152ab27d5d2d0f6d13faf65c16ecda67d6715a070

SHA512
9ca556b986f842c5b6e1565ee8f8b5aadd7aabeb4156c06d8378ab31c9beba5570c4f2533d4f6ff8727cb936b057ede308572974a74792e7b988f39bfec1aea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
3.8MB

MD5
46c17c999744470b689331f41eab7df1

SHA1
b8a63127df6a87d333061c622220d6d70ed80f7c

SHA256
c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

SHA512
4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
4e4a60272ee26fc706dabfa3a2c34eac

SHA1
745417d84fb7eed66aea8b690b67fcca69a9fbab

SHA256
308da5d0b4e6121633b5dd09378344ae411752c745f74fd4c3c4063691dd7949

SHA512
a0299bf9e24ce759947d1db118cf676af49d7c5e75d842dae493e97c1078d8ba2f82bb13192a59b132340e5bc4ca850579463c5c332a5975cfb972c8f3118d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2600b1f83f67f2255ed93f7e423fedef

SHA1
e490a2eaca257277314c4c1e8e8b14972100d12f

SHA256
d8eb0d1cf808cc7d7bc79b50d636f1e0ef11d23e12fbc85adb86deca22370f13

SHA512
f58d482c204b88b9480d499539689deabd31ba8dd7a79cec1abad3e3c841f2e6aad14eca9cbfffaf86d39b8d3ab9e2f84e77f86a5857f6848a48e1f53022f8b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
400B

MD5
25cbdfcbcc51de3830dc84136b604d2c

SHA1
edbada076ea0a6278e2abf68b8642f9d459c78da

SHA256
ed9d9101c9fb91889d2648e61df22fb68b2599216d11212f9b420d09ab234b82

SHA512
3b33d3c2483c7b76ce0ed57afb19f5ddb6909dde4b43045b16a09788de7cc98a49051404817bb330076e7363f4d471e2dc3d6baa4180cd486a3e79a7b0a9f088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
400B

MD5
258d81428debc99015bc5b784d94aea6

SHA1
fb5b6f19442e366ba9f85b9838eab3bb9695503e

SHA256
83188b4187721af7428a3d19da8b9bd0290ad0b058c69f5079f81dbec867daef

SHA512
ddd324630fe157ab7742411d5c8a62b77150a09f1f7419db4061b44a70c450526fc57e74bcfe787269bf59f13dd24e18c4dd075eaf40591f17f83610e321285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21d34e99af19212b2b8f4a1c5ba3e23d

SHA1
7cb06b0e64cf1fff63567564efc8c6d77f2960bf

SHA256
037b8aa2d912d9011a01e71b0956c49b6472d0bcff11f4a7c3f2a675b85f8662

SHA512
f84a1328f66cc06f8f03a8bed2ace8e439a66beb0a71cf15c63a001f744a55c218e10b57eeee0a9e9b1c65271a86424b4a1c46cb94946466637411efbc0676bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de43298289ebe7a2468aac83025097ad

SHA1
7b6e9ce531f4f033abdfdb5b0642d3a6ff8b718b

SHA256
3b5819197def979644a1fe0b4345141fc314b96e4bd06c747b02c2dd41f99cac

SHA512
e2bce09f6cec70da0c68e56a546eaa51efc8a171acd65a85046184a27c9ed137a8666500f7282de110fb15856dec65d74cd382e8c8e1b43b8864493595fc4f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8f4479fdba6502a1727fac3a1d7d2e5

SHA1
8e99b30a983e848280f9964fc597ec7a789a683f

SHA256
4642bf757bf50c486e82e8a8176365080c19b2f1414a7fd5ce94d9ec2b7e024b

SHA512
45b27255efd4a3584f78761b5fb623329f4460d02b64a17d82751357c9758f61a873769a7d32f0d52a00185608cd81fe268fad6afe457c3a9faae0a10c270331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9c599c24cf27655fb659101d2d74b23

SHA1
b48f7ed7d23eee077367a9a63445c68896f2721a

SHA256
360452a737fa321691bec9e5e7d9ba03c8d95b201949785f050c324b31ec60f8

SHA512
83228db36b8aa709d3294c038cb031c1fe386cc108b78d83e943f7aa5ce0883c4e364b7a38b7e8ea71fa3375699e8913ba26ee7a9527b4783d1c0cf81a7fc24a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec67ff0ef8c9dd716146b9b6638d4c93

SHA1
d94de52bddebb9cf6b16b045d7a6bb6595003bcc

SHA256
85fa59dcd439043a75941a231d94679609c19023b01f2765e22a738b57033331

SHA512
a2f464b40965949f48f9a23d98a7b28605725302bd300f33316b8a3b0a28483c4e9019d00d5031478b6abb0f972015dd7cffe4f2d8ba6702a4f8dd7fc9a9d947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a0b3c.TMP

Filesize
703B

MD5
d34f3e23daf321f6a2738eedb0c45d71

SHA1
824dcc05eb81598007fe67e799cdd5b6a250119b

SHA256
9816ab2bfd9af4ac29d360f1fa153c847330a2084477cb7cb9f657d9685d2c0e

SHA512
9b353ca9fe357bda0d701167539882f9deee429b9badab76735e22bc24299464ce6ce2d005695c869b2d71b0cb2979d188f580353bfc752503ad28ca429fcab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a2025c662c78c33fd1f13d8ffeb6e4dc

SHA1
d2e9bc22f380621e3f6d8794fd7587ab7a622553

SHA256
9a0ab040e520b09c956abe93914d3e35db00ba246eff9a74b7244cd8c147f9bc

SHA512
9f4db8b9c4fb0ca14fe8c3b7d914565dbc08c4ff98b6935b5db15ad1336adce6a1b09989de1a7f0e7d920e8256e7f26b73afc11fcc080c4f4bd59fc9b9ef66ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
23061a7ec08152ebafb988ced31b52dd

SHA1
916fc1b02c80001ef6f8a2fd097ac12cd11062a2

SHA256
1ceeb3455d60714e0e8744a885b6ff5a5b354def04e3f0c77e1b35ae264baa02

SHA512
81ad96b34b13132fceed7b0ef4bccf6584e2ea9b4f042daf5f8c6cbfe4c1572cf982afc7bbd5380c5b0f9c5ff6aeeba07c4fc04384c83877484d3b48b95e3e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
56751ea1a5b6ed1a8c2b20854f87ec8e

SHA1
e998447e3673159e7616f976add54b484b18a55f

SHA256
63fcae32fbc290be26542906f5f0a5cee7c6089537ba2158f1fc9c15c0d93d0b

SHA512
9688f1ef65e1dda4691fece5c4c73ba0b47354418caff91cddd7169626ed4a6f6eb4b6d8b947893c23203bfdba6b240ea486d736d98bdfd2865900ee8f5fc961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4d02685edea61609cfbf08ca2e4ec8cb

SHA1
8c6e02c1142cb732248c4f89d1ae16441f5c5f01

SHA256
73409d7b590105df158adeffef727b081a302bae9b2fddcc48414b48c726e1cd

SHA512
4eed4c23654479032a4a45c1efbdc792d1c6e7a0a2bb8f856f3d1970bc6128f974d3e2d4c7d7be651ed62d596c6b014d4770fa58ee232e8a14c911eb7c54a67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3536725682f24e78d85a7f710c7c6285

SHA1
f6f8c14383d7cb573a67aa6f2a64160cbdd4b288

SHA256
9e1e58abb15bf9d8b67836bed3ca95ae6d50c50b7540c712794f0edde44cac9f

SHA512
ca59935ac0714eacf987859378a5f2c4cb2c28a49cccc323014c122fc0b1267447452c4364fe56c522d67aee69339604f87fad410d1b64c65000d9d7b18225d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b18e10bf89012057e3e1a82b0e8fcd5

SHA1
add9447c7146fb338fb9ab96b2634c1f159649c5

SHA256
b89b8cfe655c8f268768e582b4ad0e04e9f7d2ac7b6c3308b1a78868f4cb7e9f

SHA512
93b3b1080167a8f649b8f3eb4fe3e2d9b1a3ed01d34a9881711149c5262466a8d9eeb1ed6d511d96ca2ea3cd018640d91280f96ce153b5e6f868367a33a92e6e

Download Submit
C:\Users\Admin\Downloads\GlobalСhеаts.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit