Analysis
-
max time kernel
61s -
max time network
62s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-08-2024 13:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/uc?id=12YeQDAR0M7mbsSxDsV_5HA_Xczo5Uqig&export=download
Resource
win11-20240802-en
windows11-21h2-x64
13 signatures
1800 seconds
General
-
Target
https://drive.google.com/uc?id=12YeQDAR0M7mbsSxDsV_5HA_Xczo5Uqig&export=download
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 1 drive.google.com 5 drive.google.com 6 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Applications OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff OpenWith.exe Key created \Registry\User\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\NotificationData OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Applications\7zFM.exe\shell\open\command OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Applications\7zFM.exe\shell OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c0031000000000002596e7c110050524f4752417e310000740009000400efbec552596102596e7c2e0000003f0000000000010000000000000000004a000000000002fd2201500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\"" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Applications\7zFM.exe\shell\open OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000002592c7a1000372d5a6970003c0009000400efbe02592c7a02592c7a2e000000a79f02000000040000000000000000000000000000002f9c530037002d005a0069007000000014000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Applications\7zFM.exe OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\xxx.7z:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3804 msedge.exe 3804 msedge.exe 1308 msedge.exe 1308 msedge.exe 2292 identity_helper.exe 2292 identity_helper.exe 2768 msedge.exe 2768 msedge.exe 4268 msedge.exe 4268 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4812 OpenWith.exe 4016 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 4016 7zFM.exe Token: 35 4016 7zFM.exe Token: SeSecurityPrivilege 4016 7zFM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe -
Suspicious use of SendNotifyMessage 28 IoCs
pid Process 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe 1308 msedge.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe 4812 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1308 wrote to memory of 1428 1308 msedge.exe 81 PID 1308 wrote to memory of 1428 1308 msedge.exe 81 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 1392 1308 msedge.exe 83 PID 1308 wrote to memory of 3804 1308 msedge.exe 84 PID 1308 wrote to memory of 3804 1308 msedge.exe 84 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85 PID 1308 wrote to memory of 1624 1308 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=12YeQDAR0M7mbsSxDsV_5HA_Xczo5Uqig&export=download1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb40233cb8,0x7ffb40233cc8,0x7ffb40233cd82⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:22⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3889870166675737941,1718324732720116145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:2860
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3160
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4720
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4812 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\xxx.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b4ae6009e2df12ce252d03722e8f4288
SHA144de96f65d69cbae416767040f887f68f8035928
SHA2567778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d
SHA512bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1
-
Filesize
152B
MD54bf4b59c3deb1688a480f8e56aab059d
SHA1612c83e7027b3bfb0e9d2c9efad43c5318e731bb
SHA256867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82
SHA5122ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9
-
Filesize
5KB
MD5ff518f12d7f8db0b4fcc6f93d7fdac06
SHA1a75a22181bd6d31db790dad7bcee8014f50b577e
SHA2566b87e0ba410a61b93d2790775e0de33b5dc34453cea845caa7ac74dc179a06e4
SHA512e6738535ae0730ba7b3226c35c4c3fabcac081d02a9a6d73ea759f97aae15954006c72108359d938f1e1959a1736b95b51764af26c601603a605252874b82c7e
-
Filesize
6KB
MD59fead410b7f3380cb83aada4af6a9449
SHA117e82252423731e128427997baad4c2cf63bddf2
SHA256a92c158b83aadbf66828b851cd716366ab0d56e7a6d656923f2e2d42ad20f4bd
SHA51208917d9f0f2f70e245663b247c6320e4bd54c59ecc8b34234e3c0edebca8e430f6e7551645eec3944f23c2c6ea02d6c980b5c3b692ccf07fe49b297f648d311b
-
Filesize
6KB
MD54c7917146c4d83c271f5ee9dcd0d8eb5
SHA1dc772ff32917a57e53a7e889f9434f761210b198
SHA256a72a10a3eeecf26b3fcd50762afbc6f1a27f96f9cc942fe942694b726039601a
SHA5127574fdc293b6e5949971429960a2ff40502c34f061cf456a2b95bb15e7359ebfbda262293e959c1689817a94e55a23e704e02ce2237042c713094f7f304d4e07
-
Filesize
6KB
MD50c4f3590ff779865f7059ecf133d85a6
SHA12629a1df11fb572049dbecded7ceb89390707cb8
SHA256d27a349644ebf529007d41e3e9fe2898f6ed1f27c63a8a141d9cbc1f9d3e5760
SHA5123ab620875c2af33f80fa5b266e14df9a64ca191511a94cab303f471358ea80261c8e05635c8afa394da34565aae5c444e8bd4c3f351e7e663f2bb38506bb3adf
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5c1ba6103cab5546c12d1cff9ffff5d90
SHA12dc7c3c0b065719089f356d3521bb6ab65e8ff47
SHA2562bc671eabc7569010f4842fe5bc6741e2c0a9461f6c1f1ed191c18c9f256669e
SHA512ad0924206e29e70922ae8b88bf66c1245f03f95a98a53da62cbdff2df55c9a084b93ae61cd8b9d2f4c388427fcc5d3ae4e2454daebee4d42f05e1fc61c982794
-
Filesize
11KB
MD55a2cafac8a5719b403b09ca77dd7259c
SHA1c55daf513c9dcf81a4c2a7af21c30e56efc81eb8
SHA2566902f14b4dec6c9eb3a8dfa61a0dc0c8ad683220e5764b08fa09bb049e97e4ff
SHA51257508b0ad76de54c0d8ec59154029eb3443cba33fec6698246b85e5afe77a2bf0d20fdf38c0a937781e9a90a658dd21ef2fbc8c401a3e9f834cbb8784b8a321b
-
Filesize
5.3MB
MD5df64eb1f576749ad1a0aa8c1a08150a4
SHA1836e7a545602d45611cdd67184652e87db9c1e8b
SHA2562090d1f23b88ca36d20c53fff853ab29fb8997c02977682fc04a3cd6ef1dfa0c
SHA512201cd188be86792294794c5063351b5a098d4fae41c047365233451e0ae7805c3f3c410d264c7d6474b954753a877db66dc2e7924846948790fbc1736cf23d6e
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98