hxxps://www[.]mediafire[.]com/file/8v0ym9nvwrkeusj/netflix+methode+[.]rar/file

Resubmissions

14-09-2024 19:20

240914-x2klna1dpn 10

14-09-2024 19:17

240914-xzvnva1cpl 4

14-09-2024 19:14

240914-xxtnrs1bmn 4

14-09-2024 19:10

240914-xvkcba1brg 4

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14-09-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/8v0ym9nvwrkeusj/netflix+methode+.rar/file

Score

4^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\netflix methode .rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3288	msedge.exe
3288	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
2372	msedge.exe
2372	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5940	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5980	OpenWith.exe
5980	OpenWith.exe
5980	OpenWith.exe
3664	osk.exe
3664	osk.exe
3664	osk.exe
3664	osk.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3004	3328	msedge.exe	78
PID 3328 wrote to memory of 3004	3328	msedge.exe	78
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 2936	3328	msedge.exe	79
PID 3328 wrote to memory of 4700	3328	msedge.exe	80
PID 3328 wrote to memory of 4700	3328	msedge.exe	80
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81
PID 3328 wrote to memory of 1996	3328	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/8v0ym9nvwrkeusj/netflix+methode+.rar/file
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff943053cb8,0x7ff943053cc8,0x7ff943053cd8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,16377719267260688131,16649071569040217461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5216

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5476

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5980

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
PID:3384
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
fdd3267579c231fa9e0edff3baaa6500

SHA1
e361a0375dfd5ead535cce40dc645b113c5092e0

SHA256
f12f65f6f993e90e791c78435cd5eb0c0bb8c2be7e4e387830f6ab8762410142

SHA512
19459ad9c5bb34885c82b53b5fae48ff4c8464eeea4c6a8ac596a2b2d0ea11b6190fb8ab328f26e33edfeb6b238fb4bdc3820ec54e78e6db203a9a28862956aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
661647ae52b503a02d543d372905fea3

SHA1
d40ccd456f68983988d4d2553f3c7920f8fb2f62

SHA256
b641f354269f4c6c201fea7cebf53e9083b36375ec8018b22398683541a7663d

SHA512
55f3f542d4d2338f3dc94bccb54e11286197ad64ce4fb0a3b18cb5e4afb43240ed804fe7a3906b56703e8c4c05e9513461f4e017a275faf1985b01c7950d47b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
7c6940d35e954ccfa88cf98e74553e8f

SHA1
e4c017079d8c6028ab8d694fc8fccc17c716a882

SHA256
f0b6f7bc8c5a7b327e4955f0bb2b18d6709297e54af95d983279831019233199

SHA512
c48434ef27640c6d7c6749aa7e0accad7bc92bea6b0d5acafd1d03057fdecfeca3c3c87ebe410ae2843899821b6908afe8e4abe8ad8929432bc5046e3bcc237d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
484b37902d4d45a1898bf7584624c3ff

SHA1
52efae0061df851bd6c05704b7ce7de39fd8083e

SHA256
e63e2eab3582fa15d8d074c8a3020294dcbf2110c9a6e2fa4f54599dba6aaf71

SHA512
0a851fba0306a9bb2b5b59cd576ca21c9d9daebafa7c0f38c9733ff370574478a2f39b3963647c11540f2e0643ffdfcdb194f411ba9194d90a018d32065812d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
69eff431ae16fdb89c986408c3669a8a

SHA1
578d0328054052bda501fb6e745a3ee3bf90e3de

SHA256
85fd8f36d70b91931754838a4797245cee082b73a921701021d24776df7b0b6c

SHA512
c62f42414628792d4f1f11bafd657491cd2ad64a5f01bea93348dba74730d94ee5b2734e92801834c4996f850383412e247db159afc4170920bc9d565ef266f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
d002e640074f3d32122bfa70e6ab5078

SHA1
cf11abf500ec2b260d9939a100409df214c09d96

SHA256
ab6fce4479b415f060c517ebc32c31838641e7966ce2c6e5b8a05d8f0180f6ef

SHA512
8ac2cc1aea3024ad191e3853e94d4043d6d9add1a4d4003204a478fa803629a953900a6a0348f3a5df428c7f0d4ab0246b262b229b49a9134e8a98747aad54e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
763f927c217399f3354787df88da4db4

SHA1
50d90b6ef0b82ef6095e967534b2a2c1386b47b3

SHA256
616cbdf9725f6bab4ccdad126e74cdfd8573b5bf491a4307a5cd5b8bff0a6c6d

SHA512
6e2e26da124154380e0ec409e1f9dd5b6a6ceb6219edf5a54ccb2cfe645e7a163073270b4ed7f4cac30877a3b0cd8968bdc32eecc05cf719af7063d0802ea734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6e7e8560140b021cc22b3a72bf3fbd0e

SHA1
7071c30eb393c2553512b177f343ea49ff921666

SHA256
aea540528461c6c60b0e80a9802d684e1dbf9fc2e9cf889ddc204541a74dfeae

SHA512
c34fd8faf69586013d4246fc9f3e35288910d9727e51c76cd3968a2d8be2f716e74f1947b577dc3aedc62fe88ac7f05eaee9ca7845f22b32593af46cbfa7576a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582074.TMP

Filesize
2KB

MD5
ae9cb9a430eaa4ab68e84ce77d1105c9

SHA1
4de0ce644be77465b2d90fe9fc45fd5ed4342543

SHA256
d9c4f0d3d8126387714f6fd48dca7e86a1fcc8685f6ceb9453d9511401123046

SHA512
a9c4352417151d4b1c69b20a77fafe2215faab5da5c87e4bffef33103256704f734b5ce6ba08e0ea30d3231a658d57151a10d5796b5a222f8653394dbaede5c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf54ff4ab447ee0b0bc3ad1f6b329408

SHA1
8930d60e70fa9c8b74a02b64969ea37335f54801

SHA256
9d6a75e8734620c595d15ebe396301d63ab2b065243b3a9a3fd4926d72e3e08a

SHA512
b0b818fc433d75bb4a34861c417b62fc1f53097a27ed43d122d93bc771ceca6adea0b08085bc9b912605e0bf82484bfa21940a033a838659fab3ef4d64d159ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
056d241da92d7be8d14e8c8b62cdaadc

SHA1
bd86770c793f06b05e762f54792f0899750465af

SHA256
a525e5349d0908a582c800432851f7336f95ab37ca016d0323d16a9833150b6a

SHA512
9c227b6d1d122e118c55fb4bc996294a1c356a21dc45f9218d5ef4a6f5185ba3e8e89a8c878e13a0519173c4ac52c47af06021e422c8b54a512c63c64b88b3a0

Download Submit
C:\Users\Admin\Downloads\netflix methode .rar:Zone.Identifier

Filesize
319B

MD5
f1c90a10433375b3cd286ef2f40f94e9

SHA1
ae2744c44d2344144c0b79281e687717034b2e1f

SHA256
b959dcf139317257153a41bca9f59b102aac4578fc573a993b382ae4837291e6

SHA512
cb37751059c6e8747fe3f96c13118bf84580c38337588ea46fbbb65160311237953f71074a0556e25cb9a8e9fc4b64371dba90dbe7dda8395aaee70bc24a7a15

Download Submit