dfcf8c83451e5579bd86e23e352a25075d400cebca399edfff8c9cc904dabdf6

Analysis

max time kernel
62s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MonkeMenuManager.exe
Size

143KB
MD5

8ac067e173cf495f6e72d30ec5813057
SHA1

feb3fcf3ea1044d88e0a912e83ef8e3c33067873
SHA256

e2b11aec9effd8d9b116dafa6bcc25002620e073a0f3f6fa24ec008fc6e40bc5
SHA512

fc26cc2bbe2a9650db5f936999ec4e6628d08aa5a7360b67fdb3210fe2e78fc55b04f6c7008db33d4f456b669489263a5eca769a0386fb9defb54d3e20efe115
SSDEEP

3072:3iS4omp03WQthI/9S3BZi08iRQ1G78IVn2ebSkcJI8ltj:3iS4ompB9S3BZi0a1G78IVhc2ct

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133721527632639821"	msedge.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	MonkeMenuManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	MonkeMenuManager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{F7C44C8B-BBAC-4D5E-AEB3-83B03DC61E6C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	MonkeMenuManager.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{79728471-A0FD-44F6-B405-5D057617E313}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	MonkeMenuManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	MonkeMenuManager.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	MonkeMenuManager.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	MonkeMenuManager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{1E2A7DF8-765C-4601-A636-EBE4BBAF8B3B}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	MonkeMenuManager.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	MonkeMenuManager.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	MonkeMenuManager.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3996	MonkeMenuManager.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5112	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
3996	MonkeMenuManager.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3996	MonkeMenuManager.exe
3996	MonkeMenuManager.exe
3996	MonkeMenuManager.exe
3996	MonkeMenuManager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 5068	3996	MonkeMenuManager.exe	96
PID 3996 wrote to memory of 5068	3996	MonkeMenuManager.exe	96
PID 4856 wrote to memory of 348	4856	msedge.exe	111
PID 4856 wrote to memory of 348	4856	msedge.exe	111
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4572	4856	msedge.exe	112
PID 4856 wrote to memory of 4532	4856	msedge.exe	113
PID 4856 wrote to memory of 4532	4856	msedge.exe	113
PID 4856 wrote to memory of 1184	4856	msedge.exe	114
PID 4856 wrote to memory of 1184	4856	msedge.exe	114
PID 4856 wrote to memory of 1184	4856	msedge.exe	114
PID 4856 wrote to memory of 1184	4856	msedge.exe	114
PID 4856 wrote to memory of 1184	4856	msedge.exe	114
PID 4856 wrote to memory of 1184	4856	msedge.exe	114
PID 4856 wrote to memory of 1184	4856	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\MonkeMenuManager.exe
"C:\Users\Admin\AppData\Local\Temp\MonkeMenuManager.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:8
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4960,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
1⤵
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=5040,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
1⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5144,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
1⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5700,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
1⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=6032,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
1⤵
PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6292,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
1⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6284,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
1⤵
PID:4408

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x380
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6644,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
1⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=6916,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
1⤵
- Modifies registry class
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffaa4ead198,0x7ffaa4ead1a4,0x7ffaa4ead1b0
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3208,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1904,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:3
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2304,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4408,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4408,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4928,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4936,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --field-trial-handle=5452,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --field-trial-handle=5528,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=6004,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --field-trial-handle=6204,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=6344,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6504,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5864,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6768,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=6952,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3260,i,12587916456308545642,5601017421504547051,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
441518babfb82845e66a4fc8ae2ded76

SHA1
e7342eb65e3beded40dd2ee2476fa0aa9e6062f5

SHA256
4da8069513e05970bea1e3543489d101f761c5f59dce02736d97f268abb86442

SHA512
9534dfd5ebaef2a0e4b81ac850944124ff676e8706ff2a74c1db46c65517471ffb9c3762405f413717ae926200bf16b22b9f95179f13d23eb54d51d481f55bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
e1e797e4133eddb0ae58f8906da9f8a0

SHA1
0d187fec2e27442817879fcef1cc8a272b77e4a7

SHA256
3031ade7333ab6348c780afe85acc8b8365cf0b77121b9f0313a9471dda24351

SHA512
9c3ea9557a914fc0d4627c3a3daf85c3295686aaeea70f0ce3268dba0d46ecce24c175b019db108b74a664c70bc0c1b7dae76492fc1e25efab45b05f3c49da92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1ae18c2e37e75572d67f9666e847084f

SHA1
b51bbf9ef4655a5b07116233dc1a1371229f0efa

SHA256
e73fdaec82ef4c9ba866ee206e6034ac913355a98ccca2e9bf1cdc38f3964561

SHA512
c648a4dec073459e09e1399a05ebb53d337fa0acb96f333a7b97d2070c4615a8af45236eec9c9579c177c34ed182c1e72515a5b3bf0392540dca11a5d8e37a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
1d3f5c6822618f3ea214e361476c72a2

SHA1
6507dbe35dd0a8a8ed69658f3d051f64453b6e0a

SHA256
9d412b3e7edf29e8fae1e471697bb5b9060181daf30b03b79f781a2daa7d5a63

SHA512
f0e162f09137e4e4b6494544e1a0d6897f7bf102a0d191440ead0906701c9353eeeddb99c87d31fcf2feaf728b803e12a991792b1f3d4adc7e8ce2a8a17b316d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
6dfd69df7b1466ec7636cd5e88d003aa

SHA1
1a6a139618bdbb2be264c19eded20f76d343d8f4

SHA256
a0c9bc0928797d7b2e871849b0e732da4b7be18bca1099e22ddac42d1dfd66a5

SHA512
f4e866d8924e820d894676f66270f4ebc25512dd069911313f0c5fde2e037a0c01bd634532f26353ab52ba221f93e9c6a4b31cf4050ec17f949fb4f822e61c50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
3eb51af955b114f1cf141aa3bfd2c204

SHA1
626860ba06a3925f2ce2d846efca9f11e9eb6830

SHA256
4fcd2a9d351be5477c415334e6d04998578d5e2205b16779713203d5ab9b135a

SHA512
d9ffd7b04d5a46eacdfc5a07f86aa648374571c4789dfe5dd70a69dfd0f536de1cb90ed9b7cbeb4bcaec5b909e128cc10776420e28386d172a46bab3b6d367a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\82d33b94-0032-4c3f-af37-43d7c236d87f\index-dir\the-real-index

Filesize
2KB

MD5
5d814d8616177fb6bb0cf84fd8e8f716

SHA1
6a2fd192685b6b735f1d37042c9aaa3210d273a4

SHA256
0511e5c0d3222cfce0e2cbf54b6795ba23bc64137d67fe0467af841145758928

SHA512
82ba39fd8f003f7374f2034c10b6f1dd38440a76e05211288b0596f36c415f4440c4665b70ec9bffa78450ff5d5d22f6f24268c5519f9393ed7aec98d6a0d16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
178B

MD5
b73ca07eeb180ef5ebbdbef0ce4c1a0c

SHA1
ca2b4829476582fa311b7b0fe6771423ae6e1ee5

SHA256
752f995256f6d6deb55f00b665839a3ef46525cb3436d77847bdb5ee8d87f732

SHA512
b132a4a821c186ac65617377b07050bbf306b68bffcc2bb8f1943746d6d424dd717f428fcb17de48bd4a1b832929985dc6894a66e41b786f151dbd8cbf7905c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
114B

MD5
a1ea65ce87d8b20d840b003f7a3b95ff

SHA1
25dcacb913754ef68b28da0199c6b737269bd3cb

SHA256
29fcb509d17631ce4534754a25886fa3e62a850f9edc2ecd0eb50a070ee1b090

SHA512
d5483e0eeac55df3fb68ef0484117cc3313827cbfce104d04d50e8237e7dd6b6079c3669240d3dacdb6be8bde321c84afbc860264be1d764bc936641f33ab138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
114B

MD5
ae236354ab35ef795a67d93c34f73ed1

SHA1
36f0fa3ce1994f516cd96bd3b480d4cca4b0900a

SHA256
91bd2137b827fe03af0d901c91a3f3af154bdbc5f383ae216a664510b67644d6

SHA512
8dc90ff50b71cf5e7e0c57e2ef6d6fded6592b2f93ed8ad597d65f95d66542e8a5d15c7ab7fc2e150bda675a338cd0dfacffe5eea12737212257258da1a0c675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
eb2feba8e78cae76a9e0f02ace774e00

SHA1
b55b6fc26a9384e29ebb5ff1219034c7f0c7e653

SHA256
2d065e9449d932f9f4e6229b73886d8d03916accf265a78bb3bbb789af18c13d

SHA512
f54d864909cb75421e2493e5b87a8b312580e121ebc677e412c55ca45f9e2c2fb1428766dab19e7a8176ac4a2e4dab100848a4e181899e9a0607505e4a727d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
69KB

MD5
f6837902aca1b938e5830d94d5d874b3

SHA1
d3809a02b7dfa75cec31152ba85f03c58006ba2c

SHA256
166601e3a7c9d7872c0284741f3db04a7d152a4785e46e6d4ee24a79b060eb69

SHA512
8a4d0274838e9d35758caade0f002797ae700a304a954f822e94e2055d23bc01d0e47bea784732cb75d3077a45b2ba399c2240c8929646c21d3453962733f6de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
65KB

MD5
00972e786f43a941cb419950b34327f0

SHA1
7b4bc7a602cc9ae0ecde62e7b973efd04156232c

SHA256
0b7287526bf50156b079dfdeff0ecbe530da958df77e4a20f7cb13ab640aac96

SHA512
90110299477c8f8dcf2a29359a8ae6cc4d6d00c28bf9a8621cf1df24ca7dda8140a3f5a270d2471020b1c23e0fba7940dbb7d6f68f1ef728ec278aeaaf511bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
61KB

MD5
1804e377acf5631dd3317b9412a90a0d

SHA1
d9a26be01d94603a4c309433b00018addb904cae

SHA256
424a17d758b2956ac54b54431867c9c5f83f75da33e220f83fd4419faf84f740

SHA512
7aa77eab8a254e2742dad4a31995cd66930b82e630cdcfcf142ebb7de8709422c55f7db65042b916e678cad1de3674559c3da923243ac312854524c3b7e288d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
69KB

MD5
af31e01952bd3ddc7394357f1b5b8795

SHA1
b9da0c5fad07f8d1a5cbcfd48d1006cee85bec4a

SHA256
a72f65166546377df2243638caf470a7624d2b88d49024d36df0dfafc2a3aeae

SHA512
d3eada3a106b9279ec9cf83d40023ddfa7e6cdb3337dc9e6f96e5da1fbed4b171ff9d281385ce2d70c93c33489f55d5ee76310fdfe9450a3e583cfe6b173ff67

Download Submit