00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9

Resubmissions

06/08/2024, 01:35

240806-bzplyayhpd 9

03/04/2024, 06:21

240403-g4fgqaaf33 9

Analysis

max time kernel
107s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
Size

8.9MB
MD5

63267d8b3821c488964c7f5dc21ce5f4
SHA1

82aceae9a96708e33d3273412ed9d2f1a6581576
SHA256

00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9
SHA512

75749f274172d15337637c0273576cf0317d713a614baaebbca286fb408f6e28efc3001972dff84b112495169c90279b00f8cf2682345e7ca544a2a09ecf5035
SSDEEP

196608:KhUC3fTTEi1xkEqX2PM+PX4SQV6jyi+S7l9I6SI78Bjn5:KhUs/EJS/jkPI4

Score

9^/10

aspackv2 discovery evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000b00000002338b-25.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Executes dropped EXE 1 IoCs

pid	Process
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Wine	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Loads dropped DLL 3 IoCs

pid	Process
968	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe
1912	msedge.exe
1912	msedge.exe
752	msedge.exe
752	msedge.exe
4536	identity_helper.exe
4536	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
968	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe
400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 2120	968	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe	87
PID 968 wrote to memory of 2120	968	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe	87
PID 968 wrote to memory of 2120	968	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe	87
PID 2120 wrote to memory of 400	2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe	88
PID 2120 wrote to memory of 400	2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe	88
PID 2120 wrote to memory of 400	2120	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe	88
PID 400 wrote to memory of 752	400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe	90
PID 400 wrote to memory of 752	400	00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe	90
PID 752 wrote to memory of 3832	752	msedge.exe	91
PID 752 wrote to memory of 3832	752	msedge.exe	91
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 2092	752	msedge.exe	92
PID 752 wrote to memory of 1912	752	msedge.exe	93
PID 752 wrote to memory of 1912	752	msedge.exe	93
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94
PID 752 wrote to memory of 3344	752	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
"C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe
  C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9.exe -a -d
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe
    "C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.skktt1.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff3cd46f8,0x7ffff3cd4708,0x7ffff3cd4718
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
        5⤵
        
        PID:3344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:3212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        5⤵
        
        PID:1736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
        5⤵
        
        PID:1044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
        5⤵
        
        PID:676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
        5⤵
        
        PID:996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
        5⤵
        
        PID:532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15469349283660338869,1244368314861308269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
        5⤵
        
        PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\f1ddc96273de42f88c5b9997ff341047 /t 2784 /p 400
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
192B

MD5
9888bafd48e16e64092487b7f995ae76

SHA1
ecfa505acb0b80ad1e03978f8693ef5468ca9c06

SHA256
53ba0b0238e96b9a75ceaa13072f3a9cb419b37133c371bce8a2a53317f5f484

SHA512
e8f2a680f484f4fc6907782ff84b1a959a5a4892ce18fd4e326bfc3478acaee99e6132773022bc9d20c54ecbb5ca0932a69831757f3f3998c19062c26d43950f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
ff811234dee513590678256e7e3ab871

SHA1
74d209759a294a291b0b60d4e39ddf1ca94e9356

SHA256
abfda05f5e6eb528c03e7ca09f4e32bc6a0f1cbbb3777b30bace2a40f2f87d2c

SHA512
efd7fc660ca099389d1d8ae64ab8402bb4886c7d49193c0ba11faddae6229bc9766be96c373ea38c30a493cc7d2754d5485737f6cb462570142e3edbe90b3957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e546d2be6e65b3dbfd311be60d8273e8

SHA1
a62726111517d910f67776944a03e2c4170dfed7

SHA256
d7214f94b15b3df5655b874486c0f757f305363b3d205bc7a565df487189f715

SHA512
6561fe4ebf77a78b0f1ce729a7bebdffe4e8478024494d0be05a38f761d22f955df0520e1ce1c20120b704fbb420784e28dbd72ba88bf4e34f63058a67c1e9e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dde3216ca730bb5d4aa750a7f9640d5c

SHA1
f67b0ec19a4e0e04b29e3a168f3fd24609448f63

SHA256
89aab65c7a2c3c6803ed541c852649dfde8c713e26d08584336de400f5aede8a

SHA512
2f2012a3f9c50c7fbfa05c1874bccf4dc0bc5ea3f62c3ae28f11babe5d5065802dc690581356ee188957c5517ea9c4b5b3566d8cd7ba781c25fe2c159b93684b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a4087c66dd78685814b010e959ef6d26

SHA1
35177331a15e373517dd0a5fa73972091956af9c

SHA256
81f96fbfab4bc4463b9829f8c58b7549c02e26e8db1d101d95ff5e7439137f1c

SHA512
3f639d415fbdcc345f6ff941eae6a5bc45a01a0043ede243eef77c295edbe0009ed79fb6a29dd8b24b750572c26faed1557a628b25259ab15bccd1dddbb7af56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fba9dfb89476e51e955ce14328496898

SHA1
75f00ea1d4520a162178bb5195a418718a205dc5

SHA256
697398b952f488eab0e4456c724d0a3df6c540e882890942ba0ca5e8a0c204a6

SHA512
c662744df7af39aba9438eefc192d8539ea1f96c763ac24dde3f78a4b0238515e54259425d34ea0792e9e72cb7bb1920bfaf9411b4e1a983641a21c3595e7147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a472184a4e1f8aebee681bf1781d0c86

SHA1
8e66a8a15f39863cce063da0dea45c2d6aafc361

SHA256
ebdb039e84d655b2ced734dad407eaff21e0c270a760faeeb3f8b3874e25482c

SHA512
3050839654ee9260288c7b6f4f1a63919b26245264908f4beacfe01a7e49add32a75e13c93ec0b6add8f04b1670451c085651c61cb269241ca56c3ce94e7e65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00cac13d1158f31b58f2e348dc9829c2549674049bc2a421c2a0cfe772ae35c9_app.exe

Filesize
5.3MB

MD5
9531abc210972973d25f5a08e3166389

SHA1
43e54f65eaf479fe2b4241531d00bf326b9393f3

SHA256
1f4509f7187154e580e2c89a782dc257933f9436bac4ff28cb7db90af9973946

SHA512
aa48c61c248d651b3a0c71464e27b659861bceecfe513a5111d7dcf221bd840cd6c72478d75be7baaafdde2f6a990470460b0fe79aecc808939062ef9698acd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cyyundun.dll

Filesize
332KB

MD5
8722259b998800a37c3991c58ce64f96

SHA1
d370272422272eaf9aca8bc17ba9bcba1b83df70

SHA256
b115d63bee020042256019ee14fa0570483180e29c4deb7ed5b8fab522b05244

SHA512
867872e22769ecdba19daca70d6ef2bbb9e310abd90ddd1c3ff5b9a3375ef11488f1f7ac021c579ab58b7e8125c8bada584a1e96bb15fcee5837307cb64a6857

Download Submit
C:\Users\Admin\AppData\Local\Temp\wincvtp.dll

Filesize
53KB

MD5
0eed4533257c57e70dfb96753e2d7afa

SHA1
b876936f10597e2f1b15a0af35da644076030376

SHA256
94fe80ee719e02e036902cc661b2ba07172de611afc3a2b8da45f1ec87bfde46

SHA512
66644a6bb211a7e3999c5ffe5301ded2e5b5f29ef1be098d3d38719758fd4f3b49fdc76623381e3d14619bf66afba65ce36ad20e299a1f63b8cdd79eee306445

Download Submit
memory/400-66-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-175-0x00000000730D0000-0x00000000730EA000-memory.dmp

Filesize
104KB

Download
memory/400-59-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-67-0x00000000730D0000-0x00000000730EA000-memory.dmp

Filesize
104KB

Download
memory/400-29-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-30-0x00000000730D0000-0x00000000730EA000-memory.dmp

Filesize
104KB

Download
memory/400-28-0x00000000730D0000-0x00000000730EA000-memory.dmp

Filesize
104KB

Download
memory/400-26-0x00000000730D0000-0x00000000730EA000-memory.dmp

Filesize
104KB

Download
memory/400-123-0x00000000730D0000-0x00000000730EA000-memory.dmp

Filesize
104KB

Download
memory/400-122-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-19-0x00000000770E4000-0x00000000770E6000-memory.dmp

Filesize
8KB

Download
memory/400-147-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-18-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-291-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-174-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-176-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-286-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-284-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-282-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/400-280-0x0000000000400000-0x000000000104C000-memory.dmp

Filesize
12.3MB

Download
memory/968-4-0x00000000741E0000-0x0000000074247000-memory.dmp

Filesize
412KB

Download
memory/968-6-0x00000000741E0000-0x0000000074247000-memory.dmp

Filesize
412KB

Download
memory/2120-13-0x0000000073C10000-0x0000000073C77000-memory.dmp

Filesize
412KB

Download
memory/2120-288-0x0000000073C10000-0x0000000073C77000-memory.dmp

Filesize
412KB

Download
memory/2120-31-0x0000000073C10000-0x0000000073C77000-memory.dmp

Filesize
412KB

Download