hxxps://getmyfilenow[.]com/lp?id=Celery%20DLL_34763689

Resubmissions

14/09/2024, 21:10

240914-zz4ymawern 3

14/09/2024, 21:09

240914-zzqq1awhkh 3

14/09/2024, 21:06

240914-zx4vvawdqr 8

14/09/2024, 21:01

240914-zvc94swera 8

Analysis

max time kernel
132s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getmyfilenow.com/lp?id=Celery%20DLL_34763689

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2629364133-3182087385-364449604-1000\{252DFAB6-9BD7-474C-80AC-B5053A141E0E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
1548	msedge.exe
1548	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
1696	msedge.exe
1696	msedge.exe
1932	msedge.exe
1932	msedge.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe
2580	CeleryInject.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe
1548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3788	1548	msedge.exe	85
PID 1548 wrote to memory of 3788	1548	msedge.exe	85
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4468	1548	msedge.exe	86
PID 1548 wrote to memory of 4536	1548	msedge.exe	87
PID 1548 wrote to memory of 4536	1548	msedge.exe	87
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88
PID 1548 wrote to memory of 644	1548	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getmyfilenow.com/lp?id=Celery%20DLL_34763689
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9b3f46f8,0x7ffe9b3f4708,0x7ffe9b3f4718
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1316 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,11235865361900431755,9101394644259785538,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4144 /prefetch:2
  2⤵
  PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4740

C:\Users\Admin\Downloads\CeleryLatest\CeleryInject.exe
"C:\Users\Admin\Downloads\CeleryLatest\CeleryInject.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db1ed3bbcaa8e96c29a0b57e72bf0319

SHA1
9bc11860837a2bcdd048613ba8dd76d6d77d32d9

SHA256
7c7db5dde536599fd7ffd4dee8e03ca0f6680e662022869057b09a4635b9b87c

SHA512
eb7375877e9b51ebcf8cfc62cf822fdce3fdce837fbbd00d4d54c52c4f67bd82408e4809e1c92f32e9f3edc9e6726910f752fbeaf14704745688b0239405e6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4b5eaf7edd9d5391ddfdb694e0cd888

SHA1
d1f92fbd238c4d5fb6861a83153893568d514586

SHA256
1d5fc1e6da67b60df30ee83dd11359ec3dbe0c4bdddff2f2f862fa9c4619d903

SHA512
1b62d5740572b1c17dadcb83d9e0017d6a8ff94cc64bc024cc47fa92a8180f7c2d18bef79ddf5cac8a9a97ecefd8461b06665e522acb0c5857dac1a2838fc048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c69211ccb669526051a86c2fcaad87ab

SHA1
e13c5c7aef8690f2d7802ff97cc671b4681e3b11

SHA256
59ca633121a0b41df3c4be3003b11c01fb67b26b3b46e755c67b4827decad264

SHA512
b7df725789cab9a957559da1ec783d7ceb1e82012bc18cfaecbcd0936bef09cc0f67e3d902df18f59d833434e5fb9b8168dd5c33489a9252190746407c159d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
996B

MD5
cad7550a5504a9dcb6c4d6c37848b9a7

SHA1
44fa83f0248896adee08c1a56ee666e0fddd1c6c

SHA256
3661cacdc6f9020e65a6fa6ef68f7ee0c0f2583f09a733f514fa6cb44cba0029

SHA512
a1d457dae8f0aec55fd08253a36e2fccf9d0a79c63608766d79228e6089fe564510e052259ec2d4600594602104d23a1e70f028df2794266753b78143bf8f390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dfca0f8769133a357b09e1c0b01f1e15

SHA1
09bbefaae74845392bec7149578b1dc8b68d93e3

SHA256
f2b496980805ceed5748d68243d3ef78cf2be7ea92221218d869e23d5e3b2c45

SHA512
d7efdf6e1356414cf231cd9ad8556d62deb092b19acbbdf9151ff09f5856b84a30a6f02eaa868fb12a3ebf6d58568779f7e2c6d82a856ac07549195efaedce2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1afa99ec68852da31fc62aed9287f97e

SHA1
b8eda8047014648b4de57394dc138f5a5634dc2d

SHA256
34ee0887621b608c06cf6f8d3749237afdb2284685d7beaa5d2e5d7e56479bb7

SHA512
f1ccfb7a662aadccf0ea17df4b512989f2579ddd4f5a9643ca9657fb83e786e38bf83e22de6e8394fda71965eb9b496b76f635a578227959e7206fd0f62f250c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc0d99b802e18dd3041888e6ce3da22b

SHA1
814ab5a88ce9db916ac454c8b6933a851ba4a67a

SHA256
3cc88cf98add7817aea36389b7e57ef44caf739cfe3a08104f13ba5b4ec41dce

SHA512
7c6b48b7d87719daae7a579704110c163b86cde35e6859704967bbf983411c00b51a93d529d543252e260c2ee326e63586fcad71322a887499988da030d71d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
367962cc538a6532db8f3820acf59473

SHA1
2d8faa120284a78323619a309e76a79b5abe85be

SHA256
bd903280de33248f11ac7d0c46227aa34e78ade58d4c57168b86b2ec8768a5b6

SHA512
21c8e2c8bc9afe622a945ddb057284a424f9315411ed73977b3a38a4c066c3ca7a9754d77694ed5e5cdaa267de44f9cc3f534a46f5c1297572200bf6bf3e2fc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16b211cc72b73627712fd59ff73f6a70

SHA1
aa3b29f1b0c02be689de3c83103ff9f736a03243

SHA256
4a748e949fbad1ddfc792fbda3c49194066ae28ba15eaf06d9c693fdbe092cc0

SHA512
d26c6e27e69d96c4c61956f5322e7fe0ed8f1c71f0f1159e5cf6b6236baf39871591486e5da0ae527028562a5fcbd072707367ba039f46f662ef54c602dca72b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
941ea4c983b3cf877ce6e1aab38f2794

SHA1
c4fcce581d0660a0c96d0579aedb528a8168233c

SHA256
3d4479f291d239eec609801437c1962e41e19c53a3eadd2f95342167fa7ad342

SHA512
f47836cc619ea50f24d3804a697bb562781e812a65285959d7dbce53db8945cbbab2f9b8290ba2bd9925f620858918ddc676c082cdadae8444a9751d642a381b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
01aa119cf188ad99cfe8fdda7a531f3a

SHA1
747181e2365e391e5a513735854628127849d3e3

SHA256
d0bf9b889666e2e04a93cfc5c61f37a1111fd6242a06d641c499d6b0fc89587e

SHA512
048b582ea54bc968fbd1551b0c37f2151006103afecbbe6bdb5d48dab3e25ee2304df272ee370bf367bbf50048704ab04c80dc542bf0524041a9822c10001a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7cff5976c22f7488453665ca55f00a75

SHA1
e598dc811c32fa7611f8e1d6b8bb175aa888cebb

SHA256
043ca68d6516c81747edb726e4163a309afb13566a90da9161379cec43d3f648

SHA512
91f9939ab77d6c0d1f6dcc1d1622f5160d4bfeffd5a298908833b7f4fbb33be69b7ec447a58c82fa23b18502e357fa5b4f752596867a1c8439ad54376bf1d8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594491.TMP

Filesize
1KB

MD5
2926406f98513b69e7e7665e6b200ecc

SHA1
54837ceac3270956833099c9262a90787fa1986b

SHA256
d4b8c2973a22080e934cc05dd7b215565621801567db6117b50bada94642318a

SHA512
f802f1dd6e41f5c932ede9ded7ffd627b8c56b1aabf9161ef5008b13f061173ceb05bd15d1232f58074c2515ff46d2f2c0dcde0bcadd09ca700f68e2f7f7ae60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
58f2349e85ba4a3bc427fa74606f4013

SHA1
f4c2225bdb8d3d1283cae4df4710345445b3fdcd

SHA256
4e7a9e368d41ff923a54daa36ed2d5b51d30bf5789040286500a8143b57ff022

SHA512
b45a53397b20d6ecae3e510f01b0ad431992b2b155a560f9e2110e5fd4eb8103d77d9790ded3c95506a474e1802ad9a6f5cb63103eac63dd177aa7ea5f4f6e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4842070388adcf73c5f818d0c5cc46e

SHA1
5816f14c9196f4f5e860e90fbff08b22dd3e1a35

SHA256
373d2e6e9257a6a5249bd1eb2100e85a50ff04632c4aedd9f57f771199e9c35d

SHA512
3917867fab365cb8e7813205a5137fa48a389012ba26f2285a5e74b9de9df76b25bae9d5a554598353c48b5a849e0dc60499aafa9880f89d8b9c8fbfcd40bdfb

Download Submit
C:\Users\Admin\Downloads\CeleryLatest.zip

Filesize
9.4MB

MD5
91865af1ff750b595a7fc53b248b16a6

SHA1
204209c944f3436e610e050427dea6dfaf780ff9

SHA256
334839a878f41c61aaaf84865762e4afa7135a9576af0bace4ce3383d2d83ee4

SHA512
e0ba77e05b9a35be252ca04e58373268baff8d0e8869cd57697153dbcfd5bb4867d2c375c13319207c726499781dbe45232fa08ac579f1bd227770f182b5ecee

Download Submit