hxxps://gofile[.]io/d/4J2C0e

Resubmissions

07-09-2024 08:54

240907-kt25hswbqh 1

07-09-2024 08:45

240907-knyvxavhph 10

07-09-2024 08:39

240907-kkp4lavgld 8

07-09-2024 08:34

240907-kglxrsveqb 8

Analysis

max time kernel
273s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/4J2C0e

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2092	winrar-x64-701.exe
3748	winrar-x64-701.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{C50192EC-76AD-4D90-954E-B13982BF6F54}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 930692.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
1492	msedge.exe
1492	msedge.exe
4592	identity_helper.exe
4592	identity_helper.exe
4388	msedge.exe
4388	msedge.exe
2436	msedge.exe
2436	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4644	OpenWith.exe
4644	OpenWith.exe
4644	OpenWith.exe
4644	OpenWith.exe
4644	OpenWith.exe
2092	winrar-x64-701.exe
2092	winrar-x64-701.exe
2092	winrar-x64-701.exe
3748	winrar-x64-701.exe
3748	winrar-x64-701.exe
3748	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2312	1492	msedge.exe	83
PID 1492 wrote to memory of 2312	1492	msedge.exe	83
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2964	1492	msedge.exe	84
PID 1492 wrote to memory of 2948	1492	msedge.exe	85
PID 1492 wrote to memory of 2948	1492	msedge.exe	85
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86
PID 1492 wrote to memory of 1228	1492	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/4J2C0e
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca88e46f8,0x7ffca88e4708,0x7ffca88e4718
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,11584482589712784845,17758899677873171272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2092
- C:\Users\Admin\Downloads\winrar-x64-701.exe
  "C:\Users\Admin\Downloads\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\5eb48e4601e742deb52c7d30d982dc67 /t 1436 /p 2092
1⤵
PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23a814eb-eae3-4c56-93f9-77fda3ada6f5.tmp

Filesize
872B

MD5
46be7af534fd748ae7b5bbc1fcc63045

SHA1
75e040a6e5d92db7d2cdf5b2a47d0e76fd1a0d89

SHA256
61cfffcc2f2a976fa89507e31b9cb86dc23e9577404d7ea1aef4baf178f981f2

SHA512
98cbac42b5ddaa7c15260a81a01f4f27166c8b90a354a3be7494da03345bb10d92e0d4fe24ccbfd83764f55191e8b90f1295258eed97b1a7a28d0ab7e919cc55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d9fca72a325876a70892b3ded0890e56

SHA1
2718ae9c3dc09972d02ff60897fe63f6e8d30a31

SHA256
bb706bad3937bb70b64ce97b2b9110d9831b7fb2359daac870fa97db164ed5df

SHA512
9d3467e2b1888d78a0a9ee826c72d56a0f4c8dbae7af03193ed095c056db219fa6d82a89f5975d0cca452a0bddbbc421bd958d2e87ea2822caf8ba50f029e318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
4548f29a7bafd93d47ab20c90865cad5

SHA1
2a5aad16374b4f7c0151a07b9bd86ccd4fa203ac

SHA256
26f169341c556dd49cbf81cc1fc44c12e98197305bd14ce985ce379678530b06

SHA512
a38b5854b31c2ce8e3a3c40792d3df5ee56568d62ff68860868ad27649f4b15c3c7e9e470924f4869288ccb41215a27c8c8454bf61baee239b64e55078f16498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e15fa20cb39d5787034e49b600b50158

SHA1
30d4a26fa01817547909f831e14a202a46a98a19

SHA256
91fe6e36c6bf677603725a565d2b13fa6b5412ba72cd5fca588ddf2b3ec40019

SHA512
3def138e38d77f795d725a79b50be33a550a4ee593750f74e364840e178b189c0a1b0b6942c6d45de1ebcc6281e9ad6ca9cd32aae00d82fae2c2a5bf278a11a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
679B

MD5
6df88efe94c0031b987a91b9163673ac

SHA1
ea50edfc8796c754fbe7ddee53bde4a874324d40

SHA256
b3cfd23119414777385cc7b3a736c1ef8805bac56bf01b87fb4a9d6d101b686a

SHA512
536d98991c4524075183551dcbdd0e7faacaa4ccc959a39e92fbf62040c89ccb5d6072bf80a6ce4e35d758387e7577a4422b1a8238d2bcbe9c510f8ec720cded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
751B

MD5
c4194a9801a3ed9ee137f8308a00aefb

SHA1
59c909ffa10face87d476e1871963e1371d562aa

SHA256
0107e377c6b2cab879e7291b6fa0517805620983e57c4d0aec8dfb78cd281cb1

SHA512
20598bb595435f7e21859f45e1cb348f4f438ca99c492fffef61971d1db10d009cc395718824b2453595bbfe8dcaff908bea5fb62a755d881eb7d6187f9d0e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
205a9040f1b306d8bd6274991010b48c

SHA1
4044969ca69c57c9e59642d0bd4733ca9cbe9c5a

SHA256
75c1c0cd2784f6435c2fc2391b143043f013bce619bc05a98973571b8613adf9

SHA512
e63fd01f43039b13e9f8559b93b9f066db89f9b01192e104214000ef058c6bdbbbd7e4d7b92ba6125903804bae1de19d57f8e3a52bd8034766f02dc5d7582fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
769cad6fb3382dac76f69b6327742197

SHA1
a9c2b7e4dd7e029c399e90e96e1b38a7ca8468f5

SHA256
8202890bddd8185e73eb5441ca229c2e53b102e0e02a7858c0532e65da423872

SHA512
80b6a5fd01958b5d35303abb6c98eb2fe63c70b9c7d8728a931e3b37d6788ec9e6f945b929ae10f32bda7bb3149653b6bc0d4d002ea32df8865883e03a2b7c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ebcb38811a4a56dcc6dd2b9a964c2f89

SHA1
96d3630588e33b1fcce6bbeb4a40fb1e43f59cf7

SHA256
aec278ef22126e372d2737a457309a9afcc4cb450cc2848d8dbe228fbe660b27

SHA512
a3d6e2f0cc293bc70173d5f5f1bea0cc1e2fab5e33a5e9c6734061ad41305efaaefe90ed9918b34084c54f0f15bce881c0f632d43aae3188d5a396b3f9ef0a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52b801b34f205ea756ff72b5bb201a0b

SHA1
b92e89233134a759d4dd3f30df866edfa5634373

SHA256
e8035fdaa8d8f6319ecd8f56ac4a2192c2947d29b02afe7dece70ba7cf9f90e5

SHA512
3b6a32a8420dfde048176c92ec34bceab6b3999de7de82050e22cadff0939643bf835d1cd3a019305b69092cc6dfc527f84e167145770e84a66ca4e764d4d4ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78ae1c1e724a0ea1c342fc33481d5c91

SHA1
93f79d98d83c4ecbd189192a9bb612097e85aaba

SHA256
8062da2bc4dc35a7269207bc3d19621e71f85ce1612f9822464488d4d1c602d9

SHA512
4370cb840bf4f49f210803e58e9abd7f1ba1bba82825b2d5d043fbf0a02292ebba8324ea008df7654f2dbe42c745ed38291f60e47bc55b21e76bfda58180ff3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33dc65d88d7480a79e55ea0bb31ad4bd

SHA1
d16c66d8916db79105dfb7a4fe94ea13123f27c4

SHA256
4c0c520a8cfe5e09e311dabe27527cf0b20f2b36997bd28886da4da2bba188c5

SHA512
daff1553c44d7cbd344556a0f216fc004c77559eaaefdff1d7afcc67fd050208f31d2e5e70ec816cf1c367c19842f706c57d77764952b4f8364bf4198085ee1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0279459bf2f6aad3e87a83c53fd54de8

SHA1
75dd1f0b0ef36f2ec1c04fe84b242506e42a0820

SHA256
20d931853aff43be529246e8fd46567a9feace7495506bb4a0b93f10be034c52

SHA512
9775e627e13b5e63147f62f4f6869f3b08b7b13a2f77687515632185146d3207dfcdc1e9fd214a19d9e31029e587cc410831891cea808a02f8a11e2e82ccf22e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58631a.TMP

Filesize
370B

MD5
c298440beb1c8f568a30902e40a74a8f

SHA1
af750a758c279549a9de06963aba86b6681203a6

SHA256
e112fbf0da23c1f61b7a8c26ca620b5f028d13c3cc0fce05d62689a6111dede9

SHA512
56a25fa13491ad8cc097b16cc187e909feccf848c7621a5ced055120aa59364fe511b3d55149c57288d9679e4b9b47979ccb177107db2a71e2bdcb2ac7b9f3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
583a0be2ab450e456ce570e80ec14683

SHA1
92f3683bf53ad9688c7efba56dfc68e2013b4356

SHA256
915207571cd0f992bb89149cc1dcad6482f9c267b658424e92af472f80dae911

SHA512
903a56123beb7fc4395adb1daacb54b71dedeb7bb71d0c26cc23d45fda03c69149513fdd6d72996fb466985a68c1aeeb660ae0590fb37a172611adb834697e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
18d68873ce03e1a43aa9e677cd508e17

SHA1
48c8e187244eddf732649211a39b869c9aace6ea

SHA256
be65f767fc1d65ef8d06b094fef1919190a8e9d1ea1a5af858a48d95981a83fd

SHA512
84b074e5d1adcbf86c8ef0facd686e8eb25a64a17679e97c8c5df0044d957cb3e8ceeb452032b84d2fd5b0f24d2a6c5364de7d689468e2ebdc455fbdcc0ad7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8cff6a5128a3285af97e003cd70be098

SHA1
975d91c5f95911329e5e39da4586ddc7d682eb4e

SHA256
5afa4c30eb589aaa9167ab42dc9a05e4c3e69c9769da7ee42d872baff42ad3d2

SHA512
799f3792660f4e7b23e9d7bcb05d9472e020db2dde3887487cef56f2f74bfae9761541043fda912b214771e503b9d98c119c170345b60690082f2dd5b0bf17b3

Download Submit
C:\Users\Admin\Downloads\Image+Logger.rar

Filesize
12.0MB

MD5
589b735f0c76d4b5d0bba07fb90a9c23

SHA1
ba0a25d41d5bdf2de4c3c56c2e05a7beb7b899e9

SHA256
93af64ccfe8c3e93bc28536724b1d1d2466d702b3841cd2cc83924846c39f7aa

SHA512
6a0718667a341c53ec5bbdc529e5710422a64a19282e2d50db40b86ac630f1028a9ecb990659d31c3f4de3c51bcd27bed9e1b0a17dbe24530a135efe7a436703

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit