Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
Resubmissions
15-10-2024 03:47
241015-ecgjlashrh 1005-08-2024 04:49
240805-ffygys1eke 1005-08-2024 03:50
240805-eee4jszepd 10Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 03:50
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
General
-
Target
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
-
Size
179KB
-
MD5
c2fea37aa19c947614c20fe2ad3aeef2
-
SHA1
16834915e3db38b5b954c2099d77bcb700428588
-
SHA256
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845
-
SHA512
e5d86b7d03c3428c59b0d0bc7e57089abc8dc8baf3dd9dde47852c43ede1e48804851cfb3ed018121b78248f8e75ed7049ea8b2d6ed6303df36514a016e98e59
-
SSDEEP
3072:ZTO/rWaQcrcfX25Qs9jRzj/rvV9Yecqj3:tO/rWayXIFVj/rvV9B
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe" 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\imageRLcHhWKQFVPfwjfGIXJjePbWQmdLze.jpg" 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exeNOTEPAD.EXEcmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4456 msedge.exe 4456 msedge.exe 3172 msedge.exe 3172 msedge.exe 3928 identity_helper.exe 3928 identity_helper.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe 4360 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exedescription pid process Token: SeDebugPrivilege 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exemsedge.exepid process 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe -
Suspicious use of SendNotifyMessage 25 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exemsedge.exepid process 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe 3172 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.execmd.exemsedge.exedescription pid process target process PID 4884 wrote to memory of 5096 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe NOTEPAD.EXE PID 4884 wrote to memory of 5096 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe NOTEPAD.EXE PID 4884 wrote to memory of 5096 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe NOTEPAD.EXE PID 4884 wrote to memory of 4580 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe cmd.exe PID 4884 wrote to memory of 4580 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe cmd.exe PID 4884 wrote to memory of 4580 4884 1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe cmd.exe PID 4580 wrote to memory of 3172 4580 cmd.exe msedge.exe PID 4580 wrote to memory of 3172 4580 cmd.exe msedge.exe PID 3172 wrote to memory of 2972 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2972 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 2352 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 4456 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 4456 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe PID 3172 wrote to memory of 3684 3172 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe"C:\Users\Admin\AppData\Local\Temp\1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Read Me First!.txt2⤵
- System Location Discovery: System Language Discovery
PID:5096 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c @echo off & echo github: https://github.com/temon_69 & start https://github.com/temon_692⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/temon_693⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8106846f8,0x7ff810684708,0x7ff8106847184⤵PID:2972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:24⤵PID:2352
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:84⤵PID:3684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:14⤵PID:3936
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:14⤵PID:3268
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:84⤵PID:4124
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:14⤵PID:4460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:14⤵PID:808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:14⤵PID:4312
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:14⤵PID:3500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11368007030431741029,5624716475901918963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:4360
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10fbdf5f-2439-4a11-b283-0db3ef9fc3fd.tmp
Filesize6KB
MD57252cb3915101495583dfd3202faaf02
SHA12e8c8fed40a027f60b43f83f3b823add3d349b98
SHA2561cbe3ee5d1b7679cc072b04acb152c014a7f30011181c907932e0ec59e326b55
SHA51209a630ed60dca5a1c17b59013ad3e420fa496df53e55053d97bc9be6b52d4968cd234712d230f76ed842eeed2e6ab0c3b21528da1b351919558405443c2ac5e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5f6b3840cc50fd95398877c2c36838843
SHA1ca4a75efcc8277e3c9ae372a4529490b567fefb7
SHA2563b4d64e03f36bf5e2ab4d4385f10ab823c959157f6fa408bf0f314b52dad63df
SHA51266607ab356c814b2d010eecf2ac8a9652ef676a30dd402dfe3b9d8df6e01ebfd2c381206ab4b03b9a03823c8ae90e5c837af8de547f40c056af8faccfafdf6c1
-
Filesize
409B
MD55fc4e74c4d38bba219819f874c0113be
SHA1a3fb5b9020c46ed9101423f7dd81d335aec02bb9
SHA25619b94f1cee30d5c9c2c0c15572c39aeace2842405c906faaf5b2c7ba7b34e910
SHA512b5625e4761ee52e339b9638d0d80db992fbce3552dd6574573d9c16e161c124177c8f5b1bdc70a78d82a252630dd73054179f73645a1d6954425daf9f01d6575
-
Filesize
6KB
MD5e793478001759a4f004d16042e8b2783
SHA135aeb27e0b9f80d058662aa34d995508bd828e6f
SHA25611cba9149fcb7e050e7787e2f8a0218ad0996115f4501fe18035dda24e19be33
SHA512ed5b858769df4c8b0f96070b3dfefcc2de5241d9d99b0dc0262eafc60ab41f2bc8cb9f6159411f87b2c7d4b942bbec3fef5c877c3cb7d6f475a9592ff8d6363c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5732114c5b092e85b1501bc13ff1d3124
SHA1061ffadb01416de8dcdb55278edfe52841408aa7
SHA2566dadb17ab2d0fdf09c501abfbc2447fb56747c267bcb0f70b18096fa04138822
SHA512ee3b2fc0c4d8fbb24fed81dafd1f021ed5ec65b1c0bd1d2a055f4f9a42567dc36221021efd78fd8b57eeacf976ffc43e950ac8b6d8f1541168baf3f857254510
-
Filesize
268B
MD5bc7ee9dffb2cf55f5fca0b0602a5f933
SHA17d7def061aa3ae9c0467cf5f126fa76b7b167482
SHA256b2b02392520557f11412437591845f013382f25a7df3c5528045ac2ba400d711
SHA5122d7bb4718a22669cbe96db6ec712c958c2154ef18c3d339262a89ca81868921df14698669f1c8fdbfbeb908b37784887c0383cb7663d3cbd6a6d4594597b3ed5
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e