hxxps://www[.]mediafire[.]com/file/ivwqxky1qq9vw0x/Serotonin_Dreaming_PORT[.]mcpack/file

Analysis

max time kernel
146s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/ivwqxky1qq9vw0x/Serotonin_Dreaming_PORT.mcpack/file

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4636	msedge.exe
4636	msedge.exe
4376	msedge.exe
4376	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
788	msedge.exe
788	msedge.exe
788	msedge.exe
788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5656	taskmgr.exe
Token: SeSystemProfilePrivilege	5656	taskmgr.exe
Token: SeCreateGlobalPrivilege	5656	taskmgr.exe
Token: 33	5656	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5656	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe
5656	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5284	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3864	4636	msedge.exe	85
PID 4636 wrote to memory of 3864	4636	msedge.exe	85
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4796	4636	msedge.exe	86
PID 4636 wrote to memory of 4304	4636	msedge.exe	87
PID 4636 wrote to memory of 4304	4636	msedge.exe	87
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88
PID 4636 wrote to memory of 876	4636	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/ivwqxky1qq9vw0x/Serotonin_Dreaming_PORT.mcpack/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc9346f8,0x7ff9cc934708,0x7ff9cc934718
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9659974328475627672,179477410783910161,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5284

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
77768ebcb60fdd60493953cef563cf3e

SHA1
059495b5eb045210b19452df012e0a9a5574c0f8

SHA256
427ce265ad5080513fd521303255b66aa9b95c79b524360efed06192c55a03ae

SHA512
234863ab09a6e7d8f7cd94331c832a4df0b50f3a97f0f3e3c94912772f8664849389ea1ac8af4b6daa3768a6ea6b975364a3ad655eb2b05f0d675faac662153a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
50ecf30badb94598cf2173641f095f8c

SHA1
1b3cbd16da27fcbfc3dba4d699df3b8c3a5bae30

SHA256
64991e462de360d03df9a458bfb4188f68e385fc071d934cfbe99af74071be5a

SHA512
f6284f7220b9fd9f08f34cf5aa7b6a60e2bed1c63248c5174a6b5ca47bc53555c58843bdaeab8e5d741d55e6dcd1ae187f1a94fd485b0412b91b7410ecaf8177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86ddcfc45417a469bd040ce83d98eb4c

SHA1
f83faf31d117e14ed1f45db490fa3f42025e5c46

SHA256
85ec5808cfeef910b2c005c7d7b188f4a5bb01ac9d411692fb8645859fd168fc

SHA512
a6e2b4e99c87bacf3ac380e8caa9e3bd8b3d7bb221eff2d6bc1aca909d7d4b3d542922b5f3e16cc6269dea6c203cca574fbc1c682ec0b14f7b61173382c79dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b2ba4720be92665888ae872c61d5eed3

SHA1
800fb1cc3ba93af0d24021da6834bf789af7c663

SHA256
41d04b03b789a178ce3ea8e24df8a9b1df42db32d828c4c0de3ae69ce651a99b

SHA512
668efed41f1eda4a02a55c7dc536fb863b927352910b3569e5adf3f86d5bd06bc983a02dfb211420018818a1e2b30e669976867e7369cd4aefe32e2ce6acf7ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
85632d2b97d6592db43951c7d61e9d41

SHA1
3d74397993a0f94329a5ee1effc3d505427d2c72

SHA256
ff5d76901ece3f9c8787d46bbbf0c38efc3df29c667c65dc3c433923403a0168

SHA512
f2aa61f90237a141b011a6f9f9fc828844deffe7ceb37fcce72fab06428786d9ed62e469a0446ca16e3fce64a075f755c506824762bedb6a4398c831f1e9bf0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
294c3d1e061610cedb615d1190746b31

SHA1
2608d8fc1ca324480ac694e1858be7c99f53c2a6

SHA256
e4d5d10341c2acf5bf5cb4f3693b7bd07385ad81a3396e7bb507e5c516490ed2

SHA512
a2c91e0ae1addabc943657b8541ede45fcd6afd95a2d32b568468d4f0c59092a4dc5a3e645f4ab3aef805c9043970ac84548798a61b6065df058dec98d68e18d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55eb77244a74ca5124b6ed079c1a2007

SHA1
ba9cbe44bad981e3dfd3e350a349780c32d19210

SHA256
ecba788117bbaa5b057fb7dff00dde41a4b9f3057fc5fea445d81578e76fa47f

SHA512
db0e4a7e7b22ec4c1196926695abc1f2774ed86819c90f451073e8cdb81b9002cc5d7a275fe8bfd8d0aad8fab245b424543068bab03f7bdeca04457180c40acb

Download Submit
memory/5656-200-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-198-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-204-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-210-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-209-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-208-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-207-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-206-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-205-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download
memory/5656-199-0x00000261764A0000-0x00000261764A1000-memory.dmp

Filesize
4KB

Download