hxxps://oxy[.]st/d/qpbi

Analysis

max time kernel
70s
max time network
72s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/10/2024, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://oxy.st/d/qpbi

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2964	Alpha.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2964	Alpha.exe
2964	Alpha.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Alpha.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3007475212-2160282277-2943627620-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 628996.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Alpha.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5680	msedge.exe
5680	msedge.exe
5916	msedge.exe
5916	msedge.exe
2568	msedge.exe
2568	msedge.exe
4972	identity_helper.exe
4972	identity_helper.exe
1608	msedge.exe
1608	msedge.exe
2964	Alpha.exe
2964	Alpha.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5916 wrote to memory of 3436	5916	msedge.exe	78
PID 5916 wrote to memory of 3436	5916	msedge.exe	78
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 3412	5916	msedge.exe	79
PID 5916 wrote to memory of 5680	5916	msedge.exe	80
PID 5916 wrote to memory of 5680	5916	msedge.exe	80
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81
PID 5916 wrote to memory of 2996	5916	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oxy.st/d/qpbi
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff6db93cb8,0x7fff6db93cc8,0x7fff6db93cd8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7480 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,14766211475152650546,13223080954217927278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8160 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5456

C:\Users\Admin\Downloads\Alpha.exe
"C:\Users\Admin\Downloads\Alpha.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2964
- C:\Windows\system32\cmd.exe
  cmd /c "title hachrecode" & cls
  2⤵
  PID:5332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
4f2b64dd619e7549465160ab2aab6f06

SHA1
518fe27f60a6aa82894e11ee1b8eee998dfa9f04

SHA256
f72b571a4b8340dd3487716ffa5bab49cd5ff0fd42d3c8f334047055877f4808

SHA512
6640d7d8555add2b472ea63e1b1a4d6b796ee94df8cf5f8e7b4b01de582c56e345b86d1a27cf780849cf4b712de69a62edb69ecc4a27be0a11dc4cac3dd12830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_download.oxy.st_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a1e3cde5b978c2fe097b208761406d8e

SHA1
03ce8ad39f8a533634e54b22667e59633f4f3747

SHA256
01d2dee770463641ca7c042b578dfb2ff7fbd6871b035a1987fcc10c4246dce3

SHA512
a7905f1aac1b6423f5e5b211bd368f4b9ca4edbf40b08097379dfa7171ba6f6a7120407e8e9c694fffbbbcd55f0d7209ae185594f4a442f5298c3ad30ba57388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e1c9ddcf21904a8b633a5cebae8fb9e

SHA1
f419987047e13866b692c19c993046223b748cb6

SHA256
17217e1c555beb0139ad3a804f2a1e8b10f591b457ee396b3002f3403cbb1e1a

SHA512
b5b9fabb95851731be96a8879899279cc1943466753160c33ba25e5521d1efc9de9d8de8c2950ef054f9bd1eef86abf1ee50e575c6f53837e77aae4e11d6ae51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f3676a1d68e83993d04c0f03b9ca5b99

SHA1
cff34783c29b3ef25162df9f293a52f39270a570

SHA256
b658c070ed497b247ae5f3bef115ea82375c2df80104095d2eeca0c70c091f59

SHA512
5b776100b95c19c0b766268503c0f96838f6eb1b44108900d214230c2371d897dac5030f48f3d0928f5e40ac7620c354210c69007688f5c196eedcad78e9d656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
04f4df01ae0fa557c17b703e810142cb

SHA1
3b7aa8838a2d01773c22159eebf22241611fc18e

SHA256
86d3370f2822f86448044cccf3fe80df974332c0569182c7c05b0f3ce8e6b81a

SHA512
c9a4aee2acdaa6ff6652df8ef549d590e10311c2ec4d17fe21157113b96aba345f0366adf2ebc4055b4c51202873e20ef80f4010f7d90b9e6f1e7c38619a7c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
630330c2838faeb598cfcb67a24dfd91

SHA1
ee8b84ed0f870493681ce476138044ba437b64f4

SHA256
ff5557f13268eb908a6604f958f5997650c0bdd3219effc16458f0c669e90327

SHA512
117dc99c8624f88537cb8d58094f5cf956377a0ba256be50b3cbc8dc7a14ee0584d7c6a45c6d27cac4e7196d7b3dd2ac359bb453e5e36921feb7d6c96951ca2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6c96bffadc939be79c3c6e14b9fa051e

SHA1
454a80bf2da323ff38cd29c611bfa061d0170ee1

SHA256
05d9e7c909a7cfaddc4012829590fa0f6c4becb5deb06f1e6e3f3a24cb8669c0

SHA512
9f02edbf16f0ee4c258a1e56e60ecb1d4b825f95b1a32c396ee1d62dc623bbffdef8e8533cad382a706f05fa381efc265ef8b4683ad11c402911f779cbd42d8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b98e6b13fb6f4bac82f7582426037a38

SHA1
628e9f9fe2913a46ad5a54c47403793fc0c16705

SHA256
200e71665423f10e5f2b7302310ce354b3d151973e9d1d34b59ec4659283c85f

SHA512
2433f7979beb2015b2bcc7fac8dacc43e6c64e157c8e85bcb828cb34517c40d90327d642f9e488d67fd66113b8ee5d5ca5a39c5d9c65774aaa75d1ba73653904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583beb.TMP

Filesize
3KB

MD5
7c33d038fde3119cd86f7bfd62ca19c6

SHA1
f22de4fdcd60b0cbba53f9f210b8d8546b0e2cf9

SHA256
5c7d6582f14e41121bcb51a86d02666793d86d27167ae6c59fa2fc8629ae8f2d

SHA512
11eae7f2c268deba77a41f8de137dd3d6788f998af7bbffc59137c8389c4d9e88c25d634790ca3df271a09ca407ddf7b27394f8405f191cb71607cfbe18fe4a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e47e621b05d0642c89e9e763d2394ad5

SHA1
9de1fd749f4422a5802667d2f6cc951f5b302b90

SHA256
5b75926f5a7f01b6810822b2c7466c9f7d50620ba61c6a2d10281f55cdeaa1e3

SHA512
cdfc35f9ec3691962b763eb51791e9cdaa3e316f4e75d58ae1ae597e5fce3ba577839c9e605805cd303d68a6cbc7e9a400c3ae0af6d46db341a5ba4be71f714e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a875f324f038709c99cc6bf007dc8737

SHA1
b47385e8b7ca2e6cb9ea6f79296fa42cacf27833

SHA256
7ed0347420e48a6eb54ebfb5065d2400c06170e4cd3501ed4e5ca7f6646e4bd3

SHA512
bff590be3ac4fcb8170aac90a13685772b0e6058ff589c39483c66a88695065d23a8b592c1b2dff98a855485c9016783e1e197e105c06d33b003269424b410db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
76cdf8ad97631fb597903928659966dd

SHA1
fe847ba7c0c910783c0d5449958eb48590366d51

SHA256
e685f25c7b1e405b4c3ad3664b87ccaddb2fda4f0621b65b2b72fefa94a427b0

SHA512
70a2cc52d0186fe5d0690556d215ebf23b956e2530b3e56b79b13943ba15282cfdb6158b9da7fddeced3782293209b582226d883c172bdaecf47324848087541

Download Submit
C:\Users\Admin\Downloads\5e0c8dc3-d5cd-420d-bbcd-453848f0051d.tmp

Filesize
17.6MB

MD5
6b67f97e21298f21088b9c51afed85e7

SHA1
23162b9bc95b0e23a28441e02fc7b986a51d6b77

SHA256
ebc307b848e0b8f8ed0d19c154f84675cae33620f09737e28313478152340f1a

SHA512
0cb570053a338553e06527f693799248ebd421deeac8a354af207f051a696f8b81ef6b76881a0368be18dcf83e360ad0bf86a13dcd0a0665bad34940c8e8fad1

Download Submit
C:\Users\Admin\Downloads\Alpha.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/2964-371-0x00007FFF79190000-0x00007FFF79192000-memory.dmp

Filesize
8KB

Download
memory/2964-372-0x00007FFF791A0000-0x00007FFF791A2000-memory.dmp

Filesize
8KB

Download
memory/2964-373-0x0000000000850000-0x00000000029D6000-memory.dmp

Filesize
33.5MB

Download