hxxps://www[.]mediafire[.]com/file/bonb70kgx2kx6ep/S0larhjw[.]rar/file

Resubmissions

02/09/2024, 17:38

240902-v7shcavapr 8

02/09/2024, 17:35

240902-v54gtsvhnh 3

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 17:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/bonb70kgx2kx6ep/S0larhjw.rar/file

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2340	winrar-x64-701.exe
4640	winrar-x64-701.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{028172F7-CB63-4FFB-9A6D-91B96537E60E}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 591368.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1036	msedge.exe
1036	msedge.exe
3896	identity_helper.exe
3896	identity_helper.exe
5960	msedge.exe
5960	msedge.exe
4184	msedge.exe
4184	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	winrar-x64-701.exe
2340	winrar-x64-701.exe
2340	winrar-x64-701.exe
4640	winrar-x64-701.exe
4640	winrar-x64-701.exe
4640	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2804	1036	msedge.exe	83
PID 1036 wrote to memory of 2804	1036	msedge.exe	83
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 456	1036	msedge.exe	84
PID 1036 wrote to memory of 1896	1036	msedge.exe	85
PID 1036 wrote to memory of 1896	1036	msedge.exe	85
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86
PID 1036 wrote to memory of 4296	1036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/bonb70kgx2kx6ep/S0larhjw.rar/file
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe59d46f8,0x7fffe59d4708,0x7fffe59d4718
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7648 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,13386757214396347380,16475056912059391580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\42a5bc4569f54ba38c48cd1e73db1274 /t 636 /p 2340
1⤵
PID:5340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4324

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0b2375e6a0344748f3e9c51f6b358577

SHA1
96b8fad3e89a516c1b013a56e355ffc7f43d7109

SHA256
d11702cc953e7c8c3fd7cb96799973bc608ebfe163598f31e08e972fc2063db7

SHA512
34e3c1eb19a25cc56207b3218e6f9464696515087d1c9381fc23dc3b54c7acfb20ec50f7b8150f6277d2587a1848ad3ef23dfb10da779947aeaace8d040b7077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
aa5082517cb5930c298bdea1fb184808

SHA1
bd88c8b58fe715c3eaa296a2976c6ada6f32bee9

SHA256
5d5152b8debfaf2285363b88fd60201796698f4f00d12d84661b83999f0bb2cd

SHA512
5efcb23ff5c02d07b863a1bec92d5bb86cc9c7ff11e8fdd7001c56d847e14ca5f2dbcd6be31ac890dd7c5944cf7ec480b406cd407825037208281c1df787f00c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af1273b78b153217120a268d0e29b1ec

SHA1
349bc8647f8ed3c4289ba49ea21a05eb79b358ca

SHA256
485e038c03f8bee466e044df2079591bf527ebf972211c59520d37a989ac5ace

SHA512
4f04fa692515ebaaf2690ff9243adbe84c55d0cdd9843d22a1ffac93076e6ed9eec10b41675ecad8202b6d0f08c709856803e6d618d5ef6528b0beebf3aae6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
f30fbec8d824c468e5f21d8a6c04babf

SHA1
e75438db99bfc3ecbf07bac20a0cbb4a296c6dec

SHA256
0b91f91d5d5b08d59daaa1c950c0fd65f7d8357c69494614edb0a5f9171e0094

SHA512
cc98f34df109b1bececd1b47a682cd8f67c84f79d4a2ee2126a9582dd82d1414e34ee0968df4b7744d9c9958c46ff2b9da6d7c0915ab41afa16c881f0cff5827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
33d52dc89b4cbd6558f1181c399bc607

SHA1
f79fce3b0660114a8b69b7dd1c18b64c357dbb59

SHA256
5bbd201d7f8bf2efe75f1643a3983b3d4efb9edb25c12e4b734c5abce4680bf5

SHA512
c070311ae3cdf31c8961855249608efa41788de7dfb72d83390bf1634d0469fab776091c324ba18119ec025ae40968619104a660d92d8cee156c950be4564ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
87eb9e524024e530466a7f9ecbac5c1a

SHA1
64b1c5447cd8864259fdf97d12b3c8b8160d678f

SHA256
1cb7f0df0f7503c4ed5e17ac161dec4ee28caa62872cc192dce8205d8de2ce59

SHA512
179f5be4ebc448548f996e813776b0a5fa76af6226a58929d152ed9927d36e0a94c8777cfb65a51c65d93bf2e83eea3faf8dd62ba4f4cd0e21d83efaf7d21851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4678016642112af02b363c3edd5b0e09

SHA1
023a30e434c24a96516c8be8ca898da5468739b1

SHA256
e95c040baa4b54f6863f493fa184bb95028fd94eedd78586299fe61dd97a83f9

SHA512
8c32cf274ea7a4c3b0142e8aac8086ba6154ce8c79d0398ad12f1b2e13d8a9fb02a7af93bd4e7979b45cea4d01a1e71aad8cd5dd6c45687ae340ea0360233d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
81c3fd231d57da91a20da2cbc13be38c

SHA1
a8fa6f259062e497823c30bb0c69f00fe352eac5

SHA256
1cc9e5af1e85f92b8f4b67e181fb1901e2200140c21fcc27e5c0ea0a6a297fb0

SHA512
bb9ccaa52fde7cf979b39d23843c602d3a8a3284f65a83e7dc0781aef4cb143054356cf6c958a3f145dafc34d29125e3226d093eaf6d6469c9a7fa17ad84b756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b84c1d25156b32a81454a296d9f06e0c

SHA1
ac35843a88bfbbe1a1c5e52b87e36a35daf89c01

SHA256
a97f9ad9da70c23a07464e35033ee85757d1079675ff3d5fcbf16099d0f4cf40

SHA512
2f9c5fcb8a515fdd983e0c2c0de9a38c1852d47bac8bbd3ddf826fc0dee523af037b3057b35762d24bb73a88172a9d4a815587f136aa4648985abf2dafb12cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
62e4c9cca63eb3f274a9b40435cf559b

SHA1
cb96c825b7be4068c6fdf2b83d64d73cc8fc9339

SHA256
594c9642fd26dbf3074782bc64ba2437ff0f4b5c4ba5e1465bd61ac6686e6081

SHA512
d300efc3916b0769a6aa286d17b5262e2c898969e0f734c5931eb4237a00a685d60d779f6ab90d986d880fd19ea176e07dc39b71a93f386c520e61080ae3bb0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dd31.TMP

Filesize
2KB

MD5
25dbcb92fd2c684083cbc04b43a242ea

SHA1
e53f9e0cbed4208880e887b1967e4c884e7ac913

SHA256
e8ea18a9da227503b58f34883f362b17f9300fb633460ec3b40d830fbf95beb9

SHA512
e51db33ff5cfa831901e39378df8a2e7b8ee1f10198c01e301df2fe8fc543339f1025f2c097c6a83f6f3c227c86f31261f189a580936ba58c8b11ed1e0eb95b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ce807f073e4fee75966636360874a584

SHA1
c8cf5e9c2ff3798d91ac50e951489deb9d86ff3e

SHA256
a5f9794bcf83058ef815e0d42235944766584b68559ec31a25728763e5900383

SHA512
17a5e708c53a91abb0af1f22a02121b677bb4a78891a59e5342a7820b2fb9b41d326e3c3b253b37bc89e8cd37516efc606f49b769b29cd8e417c618c973cf9b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9cf696b2f010fba58e8afb5030cbdf02

SHA1
1359ec421c513072c50a091a5ba6a115aece5111

SHA256
25f5cc8bb15b3b66385cdb16daacdcc448e96c30d33404b5f3ce3dd69773626f

SHA512
b666ec527c6470b15c5e019189ab61bf6f6ca21e11119ecb171f3393041c89edcf6c7db54bcbe3336712695c3f37df1f4f91ce73b2f0c387cc8e6cce2472861b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f8e9b80cad748bb78882981d6928fd26

SHA1
72a060fb90acccc621f827fb22b184c8261a674e

SHA256
4a22d242a83e5536910cf3c09559cc48652963ee9cb45fcb9000746c0dd4c52b

SHA512
0fa41ef76aedd80a42a89d997b774cba2f92f327a1cf7e6f0e66353a49c1e856db7db362e3417cf005f6332d02a99b19f8115504af20f08ca662b2f421c0163a

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit