hxxp://boarsheadresort[.]com

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://boarsheadresort.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{3D83DD52-738D-4B76-946D-01E915E20A90}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3668	msedge.exe
3668	msedge.exe
3896	identity_helper.exe
3896	identity_helper.exe
744	msedge.exe
744	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2196	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2196	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 5080	3668	msedge.exe	82
PID 3668 wrote to memory of 5080	3668	msedge.exe	82
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3216	3668	msedge.exe	83
PID 3668 wrote to memory of 3412	3668	msedge.exe	84
PID 3668 wrote to memory of 3412	3668	msedge.exe	84
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85
PID 3668 wrote to memory of 2372	3668	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://boarsheadresort.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d48d46f8,0x7ff9d48d4708,0x7ff9d48d4718
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6380001135227922085,4401328780965060828,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x150
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
47677f584b0a1521ab137dc26b133899

SHA1
ae712c76f23d608e664f4f19bdcd2aec747a2128

SHA256
542aff624aa337e10c3c1f0b4fb16905cbf86d00a967322a48d15e0a06e8ba38

SHA512
945446c4cd33c9541769ea5a154b51e910bd4eaf3bd1a814088911b6193d8199a7b854ba8639d9b2184031b002eac8e21586c51cdcfdf8594b50b9a1f26805de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
aa2557d5dee04ad6e2d48ed8884b1546

SHA1
402c8e5e208d3834ec566da8273f9a4d1f413fb7

SHA256
5b22469cc62ab33d388a3afe7ee65a71544ab4c7d6a22f8fd924992a3b01699b

SHA512
920451d53dcb570a9b771152983863da0430c765f9c27ce471d9d9d2a79952bf4dfc3a3b6b9b20f840fc2cff58b66c00c1588f0c23bf97fa8624d93737ae20b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
ff14529a994051d525d04f2510586d9b

SHA1
30f1b74cc423b91e995371117740041bfca8cb8d

SHA256
a9ae01efb8a666c9e80e9b44c0264d095b4d9ed5f7c059304461aec6715f8bfe

SHA512
17817795150847964706475329f868973fe4ac88b4aef67239d227ceaf5ef37170331da10138e2606ac32a046fe8e781e1239e25447462e412741425bc447cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c0a4787d56a3899aa2ef7456fd8dcd15

SHA1
bd6ab06bae942e1a672fe8d2110b7f21f47250b0

SHA256
1959bc155b5dce938f4618ca7c4666d9b78a543d269e2f96f32edd445239f18a

SHA512
fd7998dcaa0253c113237ba352cce4fa55f965341069a78f3342add20ba2c2120dffacf5815b8d9f9be06856c984267187926e796c0d2a1f25bd08045c42a0eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
9ed7f8979fd65a72f6beb17fc6ecffb0

SHA1
fcfdfbfea8d3c5193ab5c33c9a1c710c360db1a9

SHA256
e5cb4ce13c121cb7ec4e1c81963c8eb9215d93d5d36d6fe38677672d4cd4e8b8

SHA512
f0269c8bbbb723c38f21911c0aa116aa393801ccbdd9d3de12fa117bf7edf422ec0fcb82c25704c2fedf13b482001fdfd8fe1f025c9ccf326f168f3567702e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
119dafd1073a33c21b6708c5eb0243af

SHA1
9f2a1095c5e1acf091f2c32ca87888d4d697f300

SHA256
8997cd858172d4d8789e79398a9c7954aa998a5452613434d990c72edfc92d78

SHA512
ab28aae717feced28f3987a89b9acbfd5eb55042860827f732c4ebcdff7c2bca1502087025105a8c31c23200535936e24339af4adae71f7de11fc4bad1cbfe8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
140418c8835c0fa557e31e7672b14bd6

SHA1
65af0d6ef95ff392a288911d59f3fa27cb787b22

SHA256
4c0aa4c9ebab5c8b7a89ef22f62028bcbf6eb617dd7bbb8527c5fea5a631c0f5

SHA512
131894c419eb6d7b8d8f5a1181f265db37476a94440e815f040ae716caf61f1b6a5c5cbc3ca3724f34558c44e1390880eb5c922b613f33b9745ff049b67a032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a331bd696cc1c419ad655816b570cd4339e0d38b\e4baeeba-f566-4da8-90e8-5bb05ac7082d\index-dir\the-real-index

Filesize
72B

MD5
3c3fab79f744251ac05699a48046c929

SHA1
a9acd4c2559af8dc19f5bc95007cf46d1a5aa076

SHA256
98ab00b64cfe40ae5997c7a03ac481e7f938fbabd8e01d25cd9a5a91534533cb

SHA512
25c6230fc5969ca676ebe17258850c018b164c2933e5c0306b14f7b9bc214d12a2f8df5a72c58714d937e17b952b0a1041e9f04848a3e5a86df4383b6adbfe80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a331bd696cc1c419ad655816b570cd4339e0d38b\e4baeeba-f566-4da8-90e8-5bb05ac7082d\index-dir\the-real-index

Filesize
72B

MD5
9022c03db6493e3bf7568222d6c41eb2

SHA1
e3e7238567b777d94cf15fa339bf22864d5ef23c

SHA256
8a569949f7c6d1f1fa0f309bc9c09ee22b06648ab6ba0aba3e1b4ee577acf89b

SHA512
2fe87b86b7f56590a90bdf86197283eea4f65582e3ae652cd8cd2f120a5a19ba5dea759f09841f5eeeea7a31e24149893c1682042378bd8791f4d97332e1326b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a331bd696cc1c419ad655816b570cd4339e0d38b\e4baeeba-f566-4da8-90e8-5bb05ac7082d\index-dir\the-real-index~RFe5824b9.TMP

Filesize
48B

MD5
54646cb9722132215e2beb715cc190c1

SHA1
752b201f058438c47c7d4edd79b98adaf7757c77

SHA256
06a42d22a4ff45bcc0ec2e48bcce28b73337118cc28565d8a5f353e2e3269d0d

SHA512
5aa4de2aebf86f4450d9181a30cf1c8ae6ef4eb6d964cf596c235491c4073f44db89a156ebec1d57ca0c8a638dd09020881c40aae23f8bca89d678a22a50ddf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a331bd696cc1c419ad655816b570cd4339e0d38b\e4baeeba-f566-4da8-90e8-5bb05ac7082d\todelete_64ff27357227e09c_0_1

Filesize
1KB

MD5
6a7f2c12f0d6203bec669663c96a09fd

SHA1
c0151af886364d961321388e77f65981f409bf95

SHA256
d921c8ccdee89e7fb2551f431ab5853f646789d9cf31bfa2b298d72488ad78d2

SHA512
8882311915970ed3ca395a3bd9e7b4c95076ef6632bc25678a6824f8d5057235d504875efd4e8d59ad3dc1df5c2e9a25d88e1e11027a6350d9759424f8d52f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a331bd696cc1c419ad655816b570cd4339e0d38b\index.txt

Filesize
92B

MD5
cc05f8dbc524b699e293d8703edb4049

SHA1
c0ff75e2117ee8ef112041851770ba31f575d977

SHA256
c1058b4fcf7f179c0adcff8398d3aade9eb027aaf43df61f0d0e53ddf8fc72dd

SHA512
6d0c0103bfc24bf298f062b0d27a4ac7e9b2611fcf45b71a77280f721464668b4f26d51d0dbe439f98f53ac0a5edce80f779c7d05a87e91e9003016530a6f420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a331bd696cc1c419ad655816b570cd4339e0d38b\index.txt

Filesize
86B

MD5
5460402b4c4f392aa0c1317ce72c0c9b

SHA1
8ccbffc993ea153ab69aee8b1af48df643146e75

SHA256
0cf353c94ea0d7f28d23b8d80c351bbca6cd8b2bf86f5bf1a42ddfe4a2243ec1

SHA512
c0f6ce70a26035b34e2b219098658d3bac58401d7cd07f58389c05ad2dfb0a74dab1951ff630e825797aab96e640620f82235615adc0f5f6dff27d008acf386e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d7f7042ef137834bb4a29935b7bd77aa

SHA1
efbe48cc895b2f6c7fb7a24be81e95cab8617697

SHA256
c2ff133b038e123ee1b2d5c6cca60dcf47ba1396d81f7073c2ac0308253facd1

SHA512
354036372a1514aa0b6ea05ee674bdd916b56ddf2c207dbbda27c3f079f2dc3005bfa6e3947b720b13eb511bc75f4b2744af8e2221f050d3d90e1ca2c82daee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
29f7fee720a94ad7d3db58f2308846f7

SHA1
4f90a0dc2125140c7cb6d0169b3c45bb3751c944

SHA256
652b9b3ece1ffbe40841192cfc0621652f59d1aefcdd16337de46c1001d4790a

SHA512
d81563eb931b011b76b7ea0a3e6f6765cfbc466d2e002bf278a91be3fb24b30a81466aa82abfa6afd383450916ddb0a744f2c45c208fe43fbd9e316c5a566afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fe74.TMP

Filesize
1KB

MD5
0c39ff56d4528b1a17978624d0555168

SHA1
68edac5b4fc1ba92b1f8dc329ed8f59e1f9b832d

SHA256
886d18eda44b4cf93cb666843fd0e3a43aee7b705d7c6415f8b1ce4f865738f0

SHA512
a04cf024b4f151eba1176a4ce09ee54a6240db62c2a96918d17d4a803d4f5188e598d4f107bb5e4c50e8a2a056a4f1db10f0f79de1fc291967da65f630174dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b8d20698a3108d7a99596b86e4d54461

SHA1
85733861ff5e19f81a954e747897282d54c9a29d

SHA256
67172632aeb2006dc80a55d0e2f560489b33043b5c9d73c843ff51647c68c4be

SHA512
1e55324c3aa2210685abe178912be3f94b8fc8d7426bc44ad1efc5c92be3d92901d36317f32a15d59e90d0fcc15fb9b58c65e8db89c7966961d6f023d7035b8a

Download Submit