hxxps://www[.]fenc[.]com/redirector[.]aspx?id=1&x=0&y=hxxps://advancedprotectionservices[.]co[.]uk/greenssl/ActiveToYvalidationformsO[.]3650fficeactive[.]html

Resubmissions

11/10/2024, 02:17

241011-cq46pswamq3

06/08/2024, 12:19

240806-phlevasgnf5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.fenc.com/redirector.aspx?id=1&x=0&y=https://advancedprotectionservices.co.uk/greenssl/ActiveToYvalidationformsO.3650fficeactive.html
Sample240806-phlevasgnf

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
4612	msedge.exe
4612	msedge.exe
2108	identity_helper.exe
2108	identity_helper.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 976	4612	msedge.exe	83
PID 4612 wrote to memory of 976	4612	msedge.exe	83
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 2156	4612	msedge.exe	84
PID 4612 wrote to memory of 1204	4612	msedge.exe	85
PID 4612 wrote to memory of 1204	4612	msedge.exe	85
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86
PID 4612 wrote to memory of 1120	4612	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.fenc.com/redirector.aspx?id=1&x=0&y=https://advancedprotectionservices.co.uk/greenssl/ActiveToYvalidationformsO.3650fficeactive.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b7ca46f8,0x7ff8b7ca4708,0x7ff8b7ca4718
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6981467877218475471,11311174366510997353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

783a1831-1d13-44be-bc29-6d40823feab3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\783a1831-1d13-44be-bc29-6d40823feab3.tmp
Size 7KB
SHA256 8c84e47e21d30b5570127a650de4c8185629a5a4b4ce3b61ad74a51ae3472ff4
MD5 6e192bfc7b5dfaedce826ff46492bac5
SHA1 602eae5357f53d8b1c46110c1f813a64d7e02a40
SHA512 71d163873ddb58a408774004d4857147865002e8689a979aaf99890ada0ec2dda71ab1b584a1e88664a132a36a4e4a84f1f026781e661468297df5e190afd95d
SSDEEP 96:nek8sQJqvp71ADTNwpvWMoizRpR9RiRmR5mdeWwajzgcP244YukUWQyV+VD7AiEc:neksU1ylGWMz7fkc0wa/gcP24Xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9a58565891eff682fb9dfe440ee299a74f80fd2703195d03ff5d803743a17a97
MD5 d77fa402e38bcfb531b7bff6c6ca651a
SHA1 175706e0df68a28f9af0ddac8f26a26b6c6979d4
SHA512 95a42f9e9e4d08807f6aed65b45479846230d2cf52d5bae261a9cc6a5c859cec8b86eb08f1740017e6269496d397d5572e1cfbdaf04efbef8b0cf22ff43e1db7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ca12405ca2db35f009994b626aac54f681471e850c56cf44d9cd0b1385c0031d
MD5 a6360b8880822260dbbd68b20e0fa01c
SHA1 ff13cd1f9bd70ab2774c3934a48234f80d9c151c
SHA512 1c0838ec5b03929f92ad95420892e51981a16b6cda6a9476c6e846ff181a4672e177dd8c8b44c9987358e6efebaf583f97eb0837e814d325a3fd9f5c0cb258f3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c7c57b504d38bfb88828d0c10f3f8424cb82c8bc40216af8c8bdcefcfa3161a7
MD5 edc0227694fe44959b405b3f489be325
SHA1 591d00e5df9631519e1accc169628e168627bb4c
SHA512 94f76b331843784e6f2fb67e64fa0134a8c8897419b6cadbf21c981c9a206f2c83f5abbc1aa5cebfb297fdbccb22f52d6c7d91f7019de5f666b88718120a49b0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 c5c6c327e687d45ad4b3ac390a78915df40c03e410106045a8dfbc31d687e3ee
MD5 411bba31c9ba4b6311190c551119b114
SHA1 9e9d8721d984aec67020877bd217da6fd829bfd3
SHA512 496fe895f9697978ccce6a5ddc731d77c68a4b6e3d6f42ba2bcd0e15b54a83c5964a2359da248970f4ff959c871359229e027355534b9c2631d07dbb94dbe950
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7116b2d8067725ede65fb7bf8f315fc39e410640e960d69782ed967c15c6329e
MD5 810d374e678fc01164e43125994820bf
SHA1 737c495c6bd8633d9f66e25270d6e3170e078412
SHA512 935dd344b4539a6aa8dfa7a0789aa591a3927a607a92171385cb23e757adf5bc37db915b33b8949a80dbe811aa14938d3b1fd2f22eedae5c45beb52f4e6f05bc
SSDEEP 96:nekzUvp71EDTNwpvWMoiVmdeH44YAkUWQyV+VDCziEwb:nekzO1SlGWMX4Nro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3b39f9d301129c712e2a359195270c0d4196d8bd86889f0f05f91825ff3a1765
MD5 297ddc6d15ad602291bffee649436605
SHA1 38e431b2cd19e8cb58e0c04d0a943f0173c48647
SHA512 661b1b25f5f6e215addd369d4245ae9ed3ed017a8d38195241297634eca39f52dbfe5dfd3e5489c3a44a26b39fca077a300a547557d32659e30473d2714153b3
SSDEEP 96:nekzqvp71ADTNwpvWMoizRpR9RiRmR5mdeWwajE9lY244YukUWQyV+VD7AiEwb:nekzU1ylGWMz7fkc0waI9lY24Xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 febfa3496b681882ff9c5b1f562a6faef73a112e28a67e8c088f82f6cb2aa249
MD5 ba20fc7eb7e893db9ec6aa40baed5762
SHA1 6067219c71ed873a4f35decf9975abfac9399703
SHA512 9006073d860e88acbc6f92524c9f6cd17ae6cd5803d75ec1ab128481188907672404fcc73b439d5b97db3b3a0588c8bd11b7cc031ec8b47b6d8d084bf38b2e58
SSDEEP 96:nekzlvp71EDTNwpvWMoiVmdehuG1j44YRkUWQyV+VD7AiEwb:nekzV1SlGWMxuGh4Wrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 41d25d6b3d93163681773d00260cbea996792aef839f55eae2c617d3a6c8351f
MD5 8a57f280864b976923007598ed86ff45
SHA1 7a08ee24d1ac08f8d84f864c59f2d94132767bde
SHA512 fe547b4eaf5f4816591195576ebaccd72998c873559420e2e60f4131f661c0fb8460837dd03cfd58982ec46d69a3b01c41699a7ef13850a4f5c72d3bb6554402
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1af9f0e9b75916cae393dc801fdef9434417297e3233695df09526e3e65d7f48
MD5 d6671b6a3703224a81acf4494c5e32ac
SHA1 8e6f49b96daab08389aa8856eef3222d50f509b9
SHA512 6b0eece77c543e91163a1121061317958aceeb3115cfc224ebe6ecf8faced7c74c2c334a68227d688eb9ac9b9616b88f36e59dec1983493c521ecc8727ddd2e7
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4b55901e327d7d666b87ecd47689cecaf1005ef70539c37b389c9d25ccdfc767
MD5 7e2cdab038f0d41b3e9fe7a189702cdf
SHA1 dc275909c5d3910f6f08496f8d0c136aef1e4afa
SHA512 bb9f6ab276dab3c4119efa075753b639360d7c3ba8aee673f7667f84c09e8f4cb108997173a46ac1525e253b3cf53f945748ea252968c78dce82b20c87e42c8c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d1e17e302d68ccd9adb5d0f69ddcce4bc257e69d033beb8474ca28a5f4b6855f
MD5 6092302fa15965ee7f6be1c9aaabc8f6
SHA1 97e06b9bea832f191891fbbf42e7e383c8323a71
SHA512 1405aff1857653763935ae33048daf67e0549200a22a668ee7f582ff8f82ffb4e4fb6aa49c36a284990e45e4faf71f80efe6cc803249833932f5f7393dd0e123
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58362e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58362e.TMP
Size 370B
SHA256 f1559608b740f6dcb8a23346245ca31aa41281d0c9cd726ad61e34a630b5b6ce
MD5 2e8b01e59ff869c56a447a530be13773
SHA1 5e2d79266583f67eb3d99b50cfe2140440a6c00d
SHA512 9064572b108ad8b55efa50c1dbf951f26895e8ecf57b347b3cb8998a874ad61fd648e34afe4dfba6f581289e014d9110aa1d5d89287d7860be4a2901015d1a80
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1cff004947589385c04ad5ca71a389638c33390f1097565aa2ebb9357de3231d
MD5 96306b329bc6f8e665fef7c290f337fb
SHA1 f1f43727e3460a594f43958a9a60a196093aadaa
SHA512 8f299b07dfabac0593d6dd9490a43f2057b3071c11793b9cc1df92441e7a6c197f67da299ccb004208db48e7248cbd14e4eb79015f6338f5d98f1e8047e867dc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUtOkxru8z8ZJY5C:A9iIxuERzA83h09RZxYswxPz8g5C
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download