hxxp://music[.]apple[.]com

Analysis

max time kernel
619s
max time network
621s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-09-2024 17:43

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://music.apple.com

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "142"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
2108	msedge.exe
2108	msedge.exe
1100	msedge.exe
4088	msedge.exe
4088	msedge.exe
428	identity_helper.exe
428	identity_helper.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1856	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 4204	2108	msedge.exe	78
PID 2108 wrote to memory of 4204	2108	msedge.exe	78
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 4996	2108	msedge.exe	79
PID 2108 wrote to memory of 552	2108	msedge.exe	80
PID 2108 wrote to memory of 552	2108	msedge.exe	80
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81
PID 2108 wrote to memory of 764	2108	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://music.apple.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffbb0f3cb8,0x7fffbb0f3cc8,0x7fffbb0f3cd8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,15853568239640221842,9898311594324256897,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4896

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4076

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3040

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:2944

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24876b73-36f2-41ba-b0e0-452fd7a5ec09.tmp

Filesize
1KB

MD5
6b09c0df8d88730663f2a63e403e11ee

SHA1
acee6f50027ad5ac82807d57f7bf1b8690528cb0

SHA256
b7694e06f711b7d92e9d1abb281fc66e6d3a0e1237a06e0d2e742837876fd5a7

SHA512
bd0bf560d2637dffa0167ca94e87ad34b408984584db663e41b72d826c3ea1859fa3db9fe7ec666bca66a060f931679e305592685c0e504dd4b9d1a85bf4f31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d8b79e1df62bfaae1809d4c9eb3c5306

SHA1
2c16b347d976f9018c799da4528c99ea13bfdbe4

SHA256
e4a92f546c9314a831a04874bbd899343bd5c351548a4e25b3f62f85b1d0f6c0

SHA512
da02ac35b41ca8e03e4f99d22540b0ba88c29083c2823bca4141994b9607c3b0171e5b2278b970d12086b56596d3a6388984b6588134fa9a7858b24e56f5e27c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
03718338239b7aa1f40f6be407c2f0bd

SHA1
2915341aba6d11be169e2e5bf12d0ad93b0f8f3f

SHA256
4eaec2aae22365eb4558276eb6dfb87b4e7b99dd911de4fc35d33588b5b1bddd

SHA512
01a782f1d843271a7be084c4b63bb68b23c0dbde7de9628a1f349e86169d1567f234a6029d86190a7bddbd169913804a471995327405c583cf2aacdfac92a299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
69903174573e1acf127b71c09225b57c

SHA1
a2e883c1537a948d5cf7440e10abef711e860743

SHA256
4527628f584b04d86915c55073075e673156538344430e4f96a2fa3867769b08

SHA512
d1b1f84951ad8a2fe7801fe01287720753c7dfc0dadaae51f89dd30fcbf3d13e12ea310ef9b61eb825f7a86dadc6fa318fea635092dca9cf5a1ae4df099d8cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
818c2b1023ffc45d94d7e000e373cf27

SHA1
7a0be1b5ae6f6cff22958825e7284868f5200f64

SHA256
271357b88831746ef2e3e3afee572a450e4f45d5e79c9c6b97066e456a5edac0

SHA512
3de26a107704039a2c3ee02b4b8a17a55e1846a2d08a4456ec98faed69cf9821f9ab22b15bca3e884d4e341a21b132fea418e18f80007026b8ce364dbbc07872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f7f9e38a1d3bb20e631c26299584636

SHA1
093bd236a7da869852b969dfcebcd5a9ec2ad981

SHA256
2f34f70894c9188fe06e5369a460a1bc3eb33b6d3a7335756769989fb4bf29c4

SHA512
ed9ce9f3bc376241c9f7625dc387e9acbfb31b220b80eb51fefc65f0cc242bbd2539e8a2b3abc2de13cc6703d60111b65cc4796af2ee0164a37827fe1b5549e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2d81b9ddd0167053bee4bd5d407250c

SHA1
925dd28f7ea93a9361422230dae9047ffdbb93e8

SHA256
3d272d9bcd154a092a1acdbcd766a22baa8f0edbf35346f90196978dc5b2aa9e

SHA512
5bc4b68024b132dccf6521e95303a46767f90dbaf466a4e17f587f9c95b46b02e8317449a6ccdc503edeab4ca8aef0460ab98bae8f6644b1dc36103fb176392a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bbd409fb99a774e9b13c783a57e88d3

SHA1
eab245ba6c0a14d4b34c10e5c0ce08dc565ec764

SHA256
c85498c340f856cde9b79fcfe49626f8625b50bd258e4927f6da2692839dca87

SHA512
17318cd72423e7aa1501e0f6e9cb3c241806b0108b120fd61ba80af7cc6af8fcc2cc08e9fead8e883f035f0afccc2c9ff44ff835a421b68ba6ff261a189dfa63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
898bb233355d2f72b442a0eba599ad11

SHA1
cf2ad300b2ae2beb6b619d38a728217703730f84

SHA256
857cbbbbe0b4fef5fca7671b8b8c2ca43070d22bd7c3ac1f2c2b95fcd19f5bed

SHA512
065b1b3a133694b3f7091df882055fb72e3d245f61927810c05099c8f1b7e01bdadc09bdaced903eeb41a6da17d60c36ee442616c8a05b0499c5424ec875de84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea448d5394ee982da93258dcd9cb97ab

SHA1
643a69926d0626625c942bdc8cd7444be3017d2f

SHA256
f040b04c369efe581b3b3941d3b2dec805d894340989e5abd1a63912ab10f831

SHA512
c7d41c4819ec6d29a25efd989280de7a3b31cac674f9e3dabfee3ea2206a3dd72180d86d368cfbf1bdda81843590962d8c8bf937dd18bc951a2867268b05b55d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98ee503c709988280cf0950e18b03971

SHA1
00f54a8b94e72139b86c0585b1e35b1ee61e4bf9

SHA256
8985922477157975fa5717a15b612d8b674afc728a2318846f29d254b3087bd1

SHA512
bbb15c9e3b8fd58fb47af43c2a8cfcb6ecbd883058926135441109e4c2ff7645b05cfff848dea8db947f3448125eacbd87b0a42be0b5e93cafe5c6579586ca8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
306d2b7651a109e669d706dd02bcbff9

SHA1
6fa14d4fafa8db9c0b90fa12de948bfd246e9399

SHA256
022e29fb20c5b0ed3e086c4a83d0175aeb443f462bdcb625edbb9ab3991b33f7

SHA512
c2efafc93a869f8add3e0109836176c6ac90c3cb8cb430691a532031a68d9f7177f42b5eff6cbf29bd06e6b0ff57ca5064dc1fe0314ddfe7aafa3551cf815b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6993ae5f068feba40c2d99ecf3889816

SHA1
18818f43fb1c862ef85ce932b5fe7cb5ea606795

SHA256
ccd8062c5a490d7a60d5ccf309e15c99e8e6f0156b8659eb320a9db321dac771

SHA512
d515dddb9c92965482eb7afaf8c34a2e3898309e7f67f4a946e525303de22b682eb965bbc9b456e11d9fad871b4fc51caacc4c40b9ed0d4d41caf064543a459c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
01eaa1dc7effc435d573bbbcf3352dcf

SHA1
28decde0c1da04f7d121e21ffab22fa89f211d65

SHA256
99024860735aa462c6fbd250afb2b7ca22509e5540d6b58bd4cac34b075d9aca

SHA512
36d98f9d80dbc03c65d42b0f545f60ef38862587735e03e7807acc9c70e37788a8c7c2408d12a70a5764264c93770eb00ff13b61764477811590d822e199eaab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57efa0.TMP

Filesize
1KB

MD5
07b804da7e3a1dcba4556ac9487d66b2

SHA1
6395312190ad1014c7e256ec217c0c1604436634

SHA256
6ff9261dd31f5344300f5ab6b696b8cc4afb6ebef6a91e27c4326213eb8d1b15

SHA512
528aba05f9cc098101519e97e222dacbbea1e0927a6a4bb4d95e78ebdaf7b4cff1f677384840fcc05c77a266addfe0acf8075c5c908d561b7222d1c6d07776e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b1dde4745afbb7b380d313b7ba3f8c96

SHA1
264c71253f52b9732cd043d9e30b171f53e37f85

SHA256
b43861046464f83406dba7c4f874b6c82c0740e0ea18a72c3a3891982bd046fc

SHA512
5581ac72dbd2a21a2b06d23bb54243f9d15d5611fc438d918ca78f78981f9a5c74f2f60393f46b684a38a73d621a4242c9abb12150aabbff34d1a19ad31c88a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f1d04984a807c100f8591c0688adab2

SHA1
377bde0842574e0db1d2e862d6aaab221454f5a6

SHA256
0200bfec791c26b86d63c534c32f19c61021768733d5e02eacf558924e2e5a23

SHA512
343448b30018c4dc74995316de003d4a9355ba3bf0d2b1dda8a41680c273cd863206d519f827764a8e6d74cb5594fad0af6476e982de69c36168561759a09c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cef5d51871a27e5a7bc58514c87e2a01

SHA1
be58d91972e425cb27874bbdf06f0d16813dcfc9

SHA256
15ee57613ce4dd6eb1c6066c54da7d6cafd84b5dfb3031678b325b9addc4e9a3

SHA512
58662fc7cd8d350dd27ca7316b4ff25bdd636309b2c5ddb128c62ae384e5c8695a760b04d02ff5fc801e83c100a9f34f844567407503dbf0b03e02893875b894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-9-13.1753.3040.1.odl

Filesize
706B

MD5
602cb76e4ae603f60042166a4bc1dd6d

SHA1
e19d610d6f2f5bedf4d74f4f67eac5d72c25522a

SHA256
c4015004fda57d8bfc010c9be676fcdac41b6bc71183decbfa21cb60c06ce42c

SHA512
8d1064c0b2fe4bf39d7819806146ae6941310ec61010e97514e3ca8fbddb4c27c4505a1a9ac4575986db8d7bd3f65699ba366e634643eeda237a1e5f764b5c21

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit