hxxps://www[.]mediafire[.]com/file/k22o6o85vy8bq3i/NeptunePremium[.]rar/file

Analysis

max time kernel
360s
max time network
414s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/k22o6o85vy8bq3i/NeptunePremium.rar/file

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5452	winrar-x64-701ar.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-786284298-625481688-3210388970-1000\{8E9A31B0-5C73-4523-B972-D6BCF1C6967F}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 951450.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
3148	msedge.exe
3148	msedge.exe
3476	identity_helper.exe
3476	identity_helper.exe
5344	msedge.exe
5344	msedge.exe
4428	msedge.exe
4428	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
5936	msedge.exe
5936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5452	winrar-x64-701ar.exe
5452	winrar-x64-701ar.exe
5452	winrar-x64-701ar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 4908	3148	msedge.exe	83
PID 3148 wrote to memory of 4908	3148	msedge.exe	83
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 1272	3148	msedge.exe	84
PID 3148 wrote to memory of 2356	3148	msedge.exe	85
PID 3148 wrote to memory of 2356	3148	msedge.exe	85
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86
PID 3148 wrote to memory of 4888	3148	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/k22o6o85vy8bq3i/NeptunePremium.rar/file
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5f6046f8,0x7ffe5f604708,0x7ffe5f604718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7524 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7884 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Users\Admin\Downloads\winrar-x64-701ar.exe
  "C:\Users\Admin\Downloads\winrar-x64-701ar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,16394893654150383474,13882840507843840254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d9d76fcc071407986e5ac915d6d2f199

SHA1
2c9734f67d433bf1288db5c60779e7c8e490f8b5

SHA256
e532bfa551ea4f04fd880debf008f6daeebd20370407b46b476618d42db4181e

SHA512
addf079d455c0d42381a232e6b9b19e8cb2ccb330342f6a84332507bd9061e17b61fa3015c7c59c0cb83cbba0ee3f849f9b97867b955d6b0c3a80ae20badd0ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
473e77f18c1bcfc5f7865096e2818628

SHA1
8ae376f0e7a54b2e6c8a0d4daae6fb65f9b0c1aa

SHA256
c7ec03aca95696953313b2a1731a3d53c8c748614bc996b2a0b6f165e19ce8e4

SHA512
51b3e876aa009d539df8a2d32829108b06ffc70cbedc216d96a8c4d1d2d80cf3cef0aef3ae27317337f1e598938a2dd6eecb7142945c320836e72d4842a6683c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39b0608ed103e86a3f0616d78670095b

SHA1
90307c793b73b1e5e959b2b9a0704f940992892c

SHA256
21aa015271e3cd9ee38a3ae5d39124a75701885b5a8675dd504051449f127ee6

SHA512
488c8235fa9404548549f42450303d2fd31c3c492528019de6d2f70d54d79059a818b3793a0e4bfe4fb8b543590ae02dfd5c0554c0fb6cb707008a99cafcd771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
025479c2b4e3ba2339e82aa0211e6d57

SHA1
3d8b7f28483813df412d9bc27316bfa5f0366d55

SHA256
0b61a637e6138e2e926fa6971c02ef6a198d545b5e18d765c973ca79f4b603b8

SHA512
79e42ad5481839ce2f272e0c34b382118086c48c05fa8bdaaf509d60b124678bff5d327d1dfa216d4aacbccafca393346da5027a21d895ce8423ace85bd9279c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
40e4cfae21c0b8070979ad71bbdc686f

SHA1
ae003e69c7575cb084ec58493107ba3eaff1e597

SHA256
bd9ccfcb2e92437eeb8fe832bc77bad750a4c8f3590c1245eec12ba38bed1822

SHA512
4a4f76da9cdb3d58734608411799c52107a3d206860d1536fee89bcd741ad846e3386c23696511cc7d229208c4f3e9e4efb74cace6a638d629b8152417f07a3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
bfa6c7b333fab351c9558a3612d9b8bd

SHA1
c94df5eb64f8e4b6ffd8b6a440d5c0ffd2650282

SHA256
5844cc7aad2af1930bc8bcf6244d08e2e0c0efa694f7311ec62a6f21e2e134f0

SHA512
4b248edaa354cfb96020b47aaf90ac6f79031858dc6bac138f3e9e4d5baf6d3e1dbe9141e39ff7439b580ec6a8e82827c8cfe6130c318d3e7910f08126602566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9a332319e388f347991622deb5d9e724

SHA1
f97569ada6396d1dd118d3faeab6bcb58bfd04e0

SHA256
b07a275fe5b2cb90b2978a5278cc11b9da7dc9cfd922c06ee05deb3f15432a67

SHA512
9c892341e8be8713acadabbde2dea11f203c96623626e5a3d99b89f2aeb26c40df4cf107a0039db41d8c6df36273e27e4a7e58064c060148c204093f2b5cad9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
28aa480d2738e64edd6b3edbc1826dc7

SHA1
1d842d15b3c8061476f1949bd91317af51dcd572

SHA256
239e1d652d8ae7c71312790e432d3f0da79e8c62f89a5bea1e6f8ffd11e14a20

SHA512
136f761c2d8e03b1e15be2180760ff44fd42a7bbdcbf21ee2c86d8facf3ba2f34d687a2913caf9082b3dcd79bdd410a7876a9e4958c2fc5a3d21b4fd6c763401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6a91e65eea2aea184c6c3e7ff2f523de

SHA1
8d186fa3d68ae5996955579b78ff48b4e3cc6337

SHA256
d3f72da6b87eb9e5a4322bfac71e079848a4b6c211d45a5b98556a95c9fa428a

SHA512
0307a537220bfe47276d13ac98d2e526bdf3cda57e3f9c066b4049167c27b846cc7cb5190a32265c2c3aa3bf162e5b25f33fdeea033d3bee67c007a467fade9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
074f03ec58191732a00d6a3a97c27586

SHA1
f7c3048c65e5aaab13b354f3225ebb104daec665

SHA256
972d4a481a26db536ec1987d80fa8eaec1d924a3575e191def8c75368353cfea

SHA512
d3839ac2d431d9678a280b0ff6695f63b29c4235f592fb1098b8e460ffe215fba84c4e45c43359192356edc95b1f883feefaa827d0ad2e5f6407d6bfc0650123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c851.TMP

Filesize
1KB

MD5
aab96b7b015237011781c46365eae341

SHA1
ec32d701b0b584c9d0cb7d97da18365779df2e4b

SHA256
b98ecffefc0772336be0e6e9745b0610f89968c721a7f215559a4770dc81cfc9

SHA512
d933076545a3a04fb33cfc53f033f213d00ded85f3ae4c213522c33defd141bfea868fdeb1db3e5bf761a874afe0fdf1d9d3c054b5d7890e821ed1b40865228b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f02b1b4a-57bd-4bd0-a061-14d8ae07e816.tmp

Filesize
11KB

MD5
f6317a28769e9622635361129cbbda28

SHA1
4f1bf5a862872d4148b3e7acabf746856df088a1

SHA256
be093081020f7a30465b9eb27c426c88a291fb198ff7dfd40f75846143aac9ac

SHA512
7b5402815ca9c5e6ff0765f67f8f866b11a8f871f588e73bab6c030f96166db972a070285e30d5c0c5d5fb0a48ba702be0876ebdc6e5d85247c1e9cd6da577f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed70c35364b1887ff6a735eaf76569b4

SHA1
3d468d66a2e453f8b261fe52c8a56d3968f19e6f

SHA256
61a7dcfe67ec0b0fcfa16ff0d650e0abd0864b794a026b155800ef1d2e434881

SHA512
a9d35b23fcc9ca0ded6344f2959e70871fd4ae82b585c4b4903b1d53d6d67bd4bddf47d1728b63148b719277cc10f586fe6cb6a18a7d79b10420a4b2d7db33b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1436f3e27f3a9380525452de9ccc3c6c

SHA1
a6b7c0fe3bd0d2b2a1c3e7b0be5dc801553b6cee

SHA256
17d73571c50c7c4468cea1d58e7ee9015f0120271906b0c7012c9f914530723b

SHA512
2c9ad6ccb5c25b6278711a61212562d66099fe9682722c17889814948d36e283623a94c76be6c816de41a825bcd4b475c5c7a19293b2cefe9fe6159a8b60244f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
155063bec910b3639e3f52e65e81dd32

SHA1
67cf261964b1c1344e53bc3cb108f3a069be8a4e

SHA256
56df558bc9ecf186b554209b07fc1360a43e14c6da2b989b56e6771afe302415

SHA512
a25337f37f40296870ab8dd972812407a2070957930d537c639799028a65be61495511846b58dc302d99acb01c7f44cd280b1d069813763559fb132676508b59

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701ar.exe

Filesize
3.8MB

MD5
5e2849bef6a38ed0b163ea6128afea01

SHA1
d77e1467dcd5e6662a6b97de35cb017579af032a

SHA256
6ec13e13059bac123d839fde5770db2c87248ef862d21f5f818580287a365026

SHA512
e20bcb346b114c5e6f8f0e82d2143a7c02ffc77056983336a011fbe8e292d8fa0ed8d2aebaa6f665ffacfa1063f59a2788bc68bbe2605316d7791eec3a1e1cfb

Download Submit