d3783cba7021c8258940cda3a4347d430786cb575d48a0ce5a58007dc719477d

Resubmissions

05/08/2024, 09:32

240805-lhp69awepb6

05/08/2024, 09:29

240805-lfzb5sweld10

05/08/2024, 09:26

240805-ld91vsscln3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 3KB
Sample240805-ld91vsscln
SHA256 d3783cba7021c8258940cda3a4347d430786cb575d48a0ce5a58007dc719477d
MD5 a59a208b663bf0df354a3aef8e9de19a
SHA1 32aa1edcfc04226c267af5db9547f51d7d6fe83f
SHA512 9c8270dd19d85afec0af6521a61b3c73b8f2b72cbc8ec6db6286f913fd4791619f7394ebeebf3ef7a9b1a0c0f7612d9b8cec0ad41ef17e638ee98c8ce52212e7
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{ED10B53A-D328-4148-A461-D137F6EF666A}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 816311.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
4776	msedge.exe
4776	msedge.exe
4136	identity_helper.exe
4136	identity_helper.exe
4772	msedge.exe
4772	msedge.exe
1604	msedge.exe
1604	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 2180	4776	msedge.exe	83
PID 4776 wrote to memory of 2180	4776	msedge.exe	83
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1240	4776	msedge.exe	85
PID 4776 wrote to memory of 1300	4776	msedge.exe	86
PID 4776 wrote to memory of 1300	4776	msedge.exe	86
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87
PID 4776 wrote to memory of 1268	4776	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92ff946f8,0x7ff92ff94708,0x7ff92ff94718
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11230796491133819844,4692330410889478543,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
MD5 9e3fc58a8fb86c93d19e1500b873ef6f
SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
MD5 27304926d60324abe74d7a4b571c35ea
SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
MD5 SHA1 SHA512

Submit Download

6a29b67d-2a4d-4bb2-bab7-b7de1a34b0d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a29b67d-2a4d-4bb2-bab7-b7de1a34b0d9.tmp
Size 7KB
SHA256 716b18dd8ecc6089da5a3212b64ae207af8f5501e8ee916f3dae917dd17dea5d
MD5 11db9e2b6950a7a050b45814b01302e6
SHA1 eb1072a6752a73a2b6bbe0409192385bf7863064
SHA512 dba30dd4963249d5e9f61ba5b1d5dc7209623c2ac7f8bd15e722aab206a184f0c414b7f3dbbb540bb47a2f2de15bf2eaf6ec5a7841e3262d85c7b82cef7471ee
SSDEEP 96:ngFk/xQE1yXwp2fx2WMoiVmdeMuN15euq4piaDUWQyVeeVD7AiEwb:ngFk/WEMXzfsWM8uNjeuq4kwreA
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8a573a0ee048096cd28ea90d10657ed4ee88a23c87cfbfd3ec81cc4aeff4ea48
MD5 13e8b8872e5f3f26efbaeed046d20f84
SHA1 0acae9b5f1ea784718e57a8ba8f67aee82290f1e
SHA512 bb583e4a09f44bde42ad232170931e93b20191e255e5e280a3909f01bc96b6662a28fb1f0e74415446f719d34ff8b59f31da81debdafcfc70792a4b0149fa2b1
SSDEEP 96:ktIsHHixgcID+CZyi1MBtRuv5XVBumSTqGKtL:ktJunCZvBVumS5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 61dc8085599dda341d65b24d20ff7e55ce12953ebe1c670a3cd12c2a3d06aa8b
MD5 cd6b07b73b11c6f78f9fc0746b642921
SHA1 7bf8d6425a086bf7e39aada9ddde209e76307662
SHA512 30db797f119aadfdb6938001f4e006fae91eb16a3b8896b7d85de94a616dac927b753c86161b2a73b7d89a0387dc7e8d02c2b60a6b128046d3fcac2c1ef03ffa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0efad0979230a0ad52b8a86db0959b6d24027b160f76abb1e5cc0830f44ed214
MD5 d23846c9fa80dfaa34081638def05e85
SHA1 6aa88189d8d1ff60106ef410c0f159cbad54677d
SHA512 9c5fa3f84ad19cd89664c5724f4dfe5dca79c8daf73cf75b8c140966717bbd49bd69fded31e8d84ff19d1dbb1f087a8c7789fea27f0411cab94da48d32125503
SSDEEP 192:ngFk/YEMXzfsWMpMdMnc/uNjeuq4k+oreA:n6eM4Wuf1kwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3494a1cf3b7cb1dda82a3c6a7de1010c5a51b81a5c21a26bfbfe7679ab39a7cd
MD5 2eacefab14c5ae3575667c80cdf22600
SHA1 f06858e828c44fe9b9814d2ff7716e6578ff710d
SHA512 8edac99cf05a226a1fe94cf1eeab1a158e37684dd565eebb19f9decb9a8c416d62750d22076261769bf28adc6c74541a742669c5acd476f4b42c186329b741b9
SSDEEP 192:ngFksYEMXzfsWMpMdMnc/uNjeuq4k+4reA:n67M4Wuf1kMA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 026049290e6455505c6b5c53e13faf3c908f037547985b6aa428e4f7bd7101ce
MD5 7e6c040f2d6ccef88b407dd78f0fbaa6
SHA1 f4b17bfe89b9d4ed24f4221fa802802dc15d6ebf
SHA512 57257fe1486b5111675cd3ab44fc60b4af75be0ccd19e5d00bc2e0184857d2ce2897d2fd0e0659534f6dac000437449e1cfeed8d9eec464b43a29c3191289828
SSDEEP 96:ngFk/UQE1S5wpvWMoiVmdeH4piNDUWQyV+VDCziEwb:ngFk/1EI5GWMX4k5ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3b56674c556f85bd78252a8d579a362e6959781b23d810585c324b03a1f47704
MD5 8fedf5b4de9db5af66fafaa2407f951a
SHA1 492360da7d741eeabaf03e42d913e8921de9cf5c
SHA512 a2939bf11a061ebad587c7e763b3b4df38fae0449a84aa52930367d73ccac352f7e74bf51bb05a2926900fee6fc1e662d75c2c41c7f14507129223a6a4eb7987
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 e385be8bcefa32ecabd62195200980f60b9952a683a7211abd8c78e6a21d11f4
MD5 6b49cec6e03f08c47ac2b7906dba47e4
SHA1 8e44dc4e159d370df6770aa9305dca501d6f78d8
SHA512 c4e42982c8b8737ac948c1f6f081e993781b21646846eba5eac91866bfe603da9fb5a6d141bf6ac62807e951cd0cba6450ba75bc2f87942779c4f5c87ff839c6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 5ae50ad2b2cf1890b57356fb86e011452431fc9ff9e68c1262f1ea7750bdd826
MD5 1c95f9837496ce2541bbcd72beff95a7
SHA1 172d231168107934a77d5647ecbd3f4dd21e2ce8
SHA512 d0456fcd3380c80948d6d5400a384b1c6450eaf0e3b443cf34952b50a390baa19a4d3e69637eda1d70a8a9dce06088400b2433cd5d4dd08fb7e537618b783757
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 e8679fc0a15b3188b070d4b4b07ded4c4730021f84cab19f636ddb79d92c4bb9
MD5 e9dfa1ea8083288c8e922fc6e317e42b
SHA1 588e2781a2d0a29554beddad315dca9765449b37
SHA512 4cc8fbd02a8835f82a611baa4013170e7732741adcd8b2764896259bd43f1a80489e4002a17b990ee929d96c39c60d2e50fbf5e1a02fe18ee590d84168f0680d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58367c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58367c.TMP
Size 1KB
SHA256 7f02cb5ab0e739e70838603eee67987f65df560e8f2992c40ef5b8e32ab1e717
MD5 435aade290591673e34afc998e1e924c
SHA1 90a0784118463468427070fb6d8ed1977142d791
SHA512 a59d11da37c25c92ea81be5892f015b22e9a51c1214ee75e61f45931000a5ef52db666c98652a77323bfb80c959746ea0e4e34a07cce2909d0c3963150520d1c
MD5 SHA1 SHA512

Submit Download

a43ed318-d849-4663-8cb0-431324765619.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a43ed318-d849-4663-8cb0-431324765619.tmp
Size 6KB
SHA256 16d5afbc4e004edd54d709faaab2e644a873eee333b0c8ef132656db3d8bb3df
MD5 aaad646e5dc83ff11780f3d8b81a6238
SHA1 d06ce9d60f944fa4394b92f8d7335c0cebbfc528
SHA512 560e43ae93349e35fa23fd49ffae3cff634f76184dea7b8c40b55db67b8d6522a709d77405bc62ef90a149f643b28d3338e5f1e6f0fd3ea66d087d672342996a
SSDEEP 96:ngFkZGQE1yAwpvWMoiVmdeH4piNDUWQyVeeVD7AiEwb:ngFkZ7EMAGWMX4k5reA
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b6376df471d58337dfe9d61d0398319de5ea82b866e82bbeaf42ed535248d057
MD5 46e3ed922904acc4e45b14cbba219bb6
SHA1 714fd3cb1692ad457e4cd23b064929a0acf353a1
SHA512 ff5da2f8f21fe2fe048af2b0d67592939a8c8dd414e9d38b1bf9d87293b41ff7f1936d2eb25ebb91834b3ca7df8e8e2b4794101b18a560929f0f6693d070d4de
SSDEEP 192:soCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEzQ2RUrt558ns0KVhY3yDU:c9iIxuERzA83h09RZxYENq6HKo3yDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6d8e847d7e1c1917e414f7c47e9a1edf3ff0b904cc531bf3ba34467113248f36
MD5 4f56a80c933d072d9ff6ef63f2944f82
SHA1 e73d8ba4bc8b620e31b5eca6309abaf63d16eaf8
SHA512 7f2403fece023e78b38e363989cca14866a47a3f89d85613c94601cc94345fe5e12be5acb9ddb3507589e1e1a40eb95a93f54ce11fa30b973eeb85a2e8f84606
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEYe2RURSH8ds0KVhY3yDU:A9iIxuERzA83h09RZxYEW+ZJKo3yDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f8270d929a102ba0a5b9c2e20eb9bd6a91c98a974549cb83d0a555fef7e8fef2
MD5 ec5719760519d14087394ecf34f22e0d
SHA1 02517a8337f027ddb35c2e84f0af9a4c2227301e
SHA512 4b8c0a8e2454f8301107343c4d17942724b695addb3b3ed062d9684d7f940a5b8e08bf9baae520770ae363d469be803e3e05777823b9c2d4c52ae70c11ffa1af
SSDEEP 192:ToCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupEzQ2RUrt558Vs0KVhY3yDU:z9iIxuERzA83h09RZxYENq6xKo3yDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 816311.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 816311.crdownload
Size 167KB
SHA256 1637e22cb1952a965fe541389d9229c17e14b5aeb15a6fcf2e831d0a81b667d9
MD5 a5e52d0b9389b7a4d9bb3d727b85a92b
SHA1 b82315ecc624ea27eca16584ee5ce9fa1eccb171
SHA512 c7252bf309b197883b4fe06969edb6328f69b07aa82b37f94392e89b4486471f9aea9539e2a38fb0e68c9ac8865261ccc70916428bb05590706b76b9e74c0525
SSDEEP 3072:TlCxwVWSrh1lhL2rypKP/X6OOKeRw+Ums1YElgGaPYwI1bwecpI7kzBrDUEbwg3Y:et4Teh3uokeOvHS1d1+sNs8wbiWQu9K1
MD5 SHA1 SHA512 SSDEEP

Submit Download