a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6df

Analysis

max time kernel
114s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe
Size 87KB
Sample241030-ph8kdatbka
SHA256 a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6df
MD5 97a044186a5b1a5e800880229ce09320
SHA1 44c09628e329bb84390ed8bd4039fbbbd9cabbd8
SHA512 7b10b2dd91f615184e532e902439565f8d0a7d55b0a2e105a867b380fe65f97430164cf4810953a9c7254fa91f2e44ea3630da920389299e1daece2aba1e3458
SSDEEP 1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfexW6O:Hq6+ouCpk2mpcWJ0r+QNTBfe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
3492	msedge.exe
3492	msedge.exe
4156	msedge.exe
4156	msedge.exe
4688	msedge.exe
4688	msedge.exe
1800	identity_helper.exe
1800	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5332	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5332	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3496	3472	a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe	86
PID 3472 wrote to memory of 3496	3472	a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe	86
PID 3496 wrote to memory of 4952	3496	cmd.exe	89
PID 3496 wrote to memory of 4952	3496	cmd.exe	89
PID 4952 wrote to memory of 1948	4952	msedge.exe	90
PID 4952 wrote to memory of 1948	4952	msedge.exe	90
PID 3496 wrote to memory of 4156	3496	cmd.exe	91
PID 3496 wrote to memory of 4156	3496	cmd.exe	91
PID 4156 wrote to memory of 4500	4156	msedge.exe	92
PID 4156 wrote to memory of 4500	4156	msedge.exe	92
PID 3496 wrote to memory of 2452	3496	cmd.exe	93
PID 3496 wrote to memory of 2452	3496	cmd.exe	93
PID 2452 wrote to memory of 3324	2452	msedge.exe	94
PID 2452 wrote to memory of 3324	2452	msedge.exe	94
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 1128	4156	msedge.exe	95
PID 4156 wrote to memory of 4504	4156	msedge.exe	96
PID 4156 wrote to memory of 4504	4156	msedge.exe	96
PID 4156 wrote to memory of 3284	4156	msedge.exe	97
PID 4156 wrote to memory of 3284	4156	msedge.exe	97
PID 4156 wrote to memory of 3284	4156	msedge.exe	97
PID 4156 wrote to memory of 3284	4156	msedge.exe	97
PID 4156 wrote to memory of 3284	4156	msedge.exe	97
PID 4156 wrote to memory of 3284	4156	msedge.exe	97
PID 4156 wrote to memory of 3284	4156	msedge.exe	97
PID 4156 wrote to memory of 3284	4156	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe
"C:\Users\Admin\AppData\Local\Temp\a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AFF7.tmp\AFF8.tmp\AFF9.bat C:\Users\Admin\AppData\Local\Temp\a780eb441cfa2e46d6723def0e93ce88afd839b7d91687aa2ce1ded35bd5a6dfN.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa9b0d46f8,0x7ffa9b0d4708,0x7ffa9b0d4718
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9236334800265525683,12160184910386618789,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,9236334800265525683,12160184910386618789,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9b0d46f8,0x7ffa9b0d4708,0x7ffa9b0d4718
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3988 /prefetch:8
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=176 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16911621568028977859,14236247946921995939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa9b0d46f8,0x7ffa9b0d4708,0x7ffa9b0d4718
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,12341869311111032341,15110978560620468185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
MD5 SHA1 SHA512

Submit Download

068dc8f6-c32b-4a20-91d1-e96cb2c2187d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\068dc8f6-c32b-4a20-91d1-e96cb2c2187d.tmp
Size 1KB
SHA256 9c569488af6fd738271413971b1ace90387e98e99f142fc0858056553ff73fa0
MD5 1aed0f8483ce6b81f99f0a6f73eda201
SHA1 da1e373b593a6b319405800157856a0edd1aabdd
SHA512 65a7a7325fc6738f4f9352efebb49f189b867c54e4f156bf300599932a6c4a6d881e8f8e1e37c6d1e7d29e75e48eac210e5b78b7cfe529bf2057c3bf9b53ac74
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 51be978a53bec330df4c83260c56aa985dc44500c048848deaabc4a13fd2850d
MD5 772740c065ec3a71c534e6a83b88bb32
SHA1 930e563b29d945787a09c11fd65ed210ab647334
SHA512 124fdbc71b26ba1aad3764be1eb843b86fc99932d62beae3ad64b8ae5108b8d339c57b54f9996080d78aa01d523daec93cf412a99ddca0a34cadd3651ad64edf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a8bf9f705f3f1cd19c932c8f33db45b62c741bee356f468b47a2217822590605
MD5 75d09680bf5c27c3adc7c347ff44b992
SHA1 73c59ff4d32c0f8b2b28ccbdce3f26eb0f741025
SHA512 e618493c8a48cd86dfcf89d50ac3300d8cb1729236e2efd1db23340081f665dc790ae882ad2b8a1ac1836a9ef520f9a90942376f3743fcc672cadeab2eba6187
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0f8d5edf2b330d866bf74422560212b576df951f7c535a75a28a7455a098bc77
MD5 04772b3e3fa897bce190319b858cc725
SHA1 40b11cf7cbf6630b2b52da1de57ecb7d486f35ca
SHA512 8cd347c45b006d4a572a70f1b14b2f052bca0a788f6ca8963a062b04d03bc88e7b29d8ea037e289f3c6eef18e56dcc0f47bc263f37510953fcb5eb7bf64a9a0a
SSDEEP 96:nvkw41J7wpvWMoiVmdeHhOMPLUWQyV+VDCziEwb:nvkxL7GWMXcGLro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 66588618744836cde2c9b188782594d354b57565277d4401966cae8e4b57de79
MD5 199ee27c1a7e26a35c356e2d5f78334e
SHA1 e3dcab4ec7b11feceb17f34d805feb2e9c197b16
SHA512 07a4c5d8c2b5a0e20d2299bca08cb67fac198d58e3ed74218aef8895fab1b948697b0c3b300e9233f0e74a0ad3b43fcf5d9315ed4cd8037b79784496235ce8fd
SSDEEP 96:nvk/41Z7wpUbWMoiVmdemuV1tuE1+2Yum1NghOmPLUWQyV+VD7AiEwb:nvkQ37BbWM2uVHuEnYumrgcgLrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e4a98edf-412c-44d5-82f9-b1dba046fe98\index-dir\the-real-index
Size 2KB
SHA256 899fba122172ab4d085420b004b0604eba72f1295f6568048bec4baa73f830b4
MD5 7d5bea87d02edc4be6946318f5dec250
SHA1 1113ae7c088dee9ec139587aebd5593338a0564c
SHA512 cd0e7472d577420cd025b1cf1913d5e3f0c054709dddbd7bda44c89a8f5989f4919ae019d4984ccd88820a935d9dc1d8b1f008338101a4ff4f549989998c3a9d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe581b43.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e4a98edf-412c-44d5-82f9-b1dba046fe98\index-dir\the-real-index~RFe581b43.TMP
Size 48B
SHA256 4754744f4aef2299d2b8989b592cdbdcdb50274d10da9a2cc40009fbce24d6d0
MD5 3c4dbe66914fd2480d8e096bf460c21c
SHA1 7975785c60e448580314f2ed18b7a358b85621b1
SHA512 4a2322ed1ffa7a5060049e83f60626d5d816d2438aaec530fe93914744250289eb9c282e58fa127bba9ebbe5ba6921a5ff9a042e67c90fd254aaf9f8e04a6986
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 d2f5dc40dd288d4b7737bec4cd81463bb54f5dac69c8b394497214467cf3d997
MD5 1e8524c897b1566ff8ee6749a54933f5
SHA1 188d416e4134713941e871729b7e66d1856e4151
SHA512 7de5ddd66208f700e1fdbdb0f30dc9994baa0e776fa85f2fb0de5d14d56318a837ead05d7ae24d012f72883e0d2d00d3cb42d7190235a81c77520e14fb5b9f5a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 1ab2ef7081abfa65f7cb58a9ee4a62a9cc672e5023516d1e59de0d7c624f0423
MD5 eb19b20c4d1ac7615bf425016ca5a2fa
SHA1 9943ae0282f312eaf65fd4c57bd467ca82f427bb
SHA512 572fdaba8b0f414335bc8c05b0ca30cf0369e3c7cedc47df10b9adaa90d5beb2855ed41c2d806d6e831e9c4d3e65313cc3ea2a29cd5fe7572fd3060cc4ad5f8c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 84B
SHA256 321c063690dc869a114e74285af9b1d3517b741fc14bafa594d97bf9054096f8
MD5 089b87a52541965706ccc8fd0cb2248a
SHA1 8d74e819c3fc97ed677926625e4aa91d9b76d688
SHA512 cb6f8795d00b94f25c9972bc1500653a0581a96a2d887bd597dbe44932a99736c5ba8c66bba5097a2bbc24253186ccfa3697bfc657000900b24e6f415adf6ea4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 056bd5e3da89925481eca58998fa658362787d7519d060a1af561ed08750faa0
MD5 c5e5337a8b4c28a345c9bb9aa5794556
SHA1 3bc81ae2b89d8e9db4c3e76a67602c312e7db102
SHA512 50143a1fbda077cb121a7b36779d33887ce780b46b988b2abdb22332cb53984f59b5da425ee0468b1e460c0a63d928383c74b758bcd46b82d8f537a4d0fee58e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 03f6779a24dae2f291f397a25b8ab54c915346c12891650e400e85196ed36a34
MD5 6ce75c990956324e31696f16f8e5588e
SHA1 e627a730dd1b220d9151888de64204d563a43fdb
SHA512 1803a97a538e05e433c25a2e0e3c651eb20d5a808b25cc66631cfe3d08682cbacf8fbe41d9bbc16fe0aaea5ccdd9001f8096cc6c40613f09a2c0c208ed8dec81
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe581316.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe581316.TMP
Size 48B
SHA256 b434984b9283d14e4e23adef6da6ebbe02a5eddc546b8b7d0d13f038b7da885b
MD5 82c6aedae136c1fbe08cc1ed8f6b2786
SHA1 cf0e9441aebab68771754363ae88242d5daa10a8
SHA512 56a959e59ac1cd0fa8051150aa43204f173d293f55b9342aec8cd978f551ffb4e7787712dd84c2c7eb4ca5c9bf643a9d044eaede4cb0a3888083a00282665cbc
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d59ff4807ec7a0d5ee3f124a786ac9e488ca9ee8882b9096f48ab9590df2d357
MD5 d424761e1d2a7c8e7dcdfba12f57b113
SHA1 369c08c8538c9af7603197cbddb93ed9565e62bd
SHA512 4c95272603cbe8ed46d44fa9b613a65a1cc7706c3f3cdb83be0feae58e26b6d9eb1f9de41d084a19164b2d1fa5a1b73bbbca6f7c9aca2ee6a0a6a1cdb3b1a68d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 286645176cde7b91bf2ec71895922007e42008b40efe3b5095e80257de81ab40
MD5 261ffba836663882b58cb5d755daac22
SHA1 eca0931433c7e6bab50ca407ef30c3ce5f82967f
SHA512 7482fa55bd0512bb24723412f0e8c13c4ae766e918c61dee9049bfcf961afb74cb1df4d5e2b069de248ec7a07586216ce2fb9e9efdb472d970123cb3871ffd6b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c8ffb60fece308faa56001a3d20ddb30dba6ac30660f60b4e08081670686754
MD5 f03166f4a8d8fe00db91a52f4dc4762c
SHA1 71dfd6b153082f5c993f79cc5b383c64526e5962
SHA512 155a309ccc849be8aded5497503d7fb25f3a6985671069923765450cb2ebba26bb8f4694dbcc349b6c50bdd5443ebaae33acd1b6b2d18be9dd84e625530e306e
SSDEEP 192:JoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup58Ace2RUMCIsoTEu:19iIxuERzA83h09RZxY5uyowu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60f74266d3a522622e26220b3df72e19e6a2a0de3e18e3b1cbab270a8fecbc35
MD5 06977f08293625b5d90964ab0345dfb9
SHA1 3da2c161205ff788ca927e7915d5d898fe68b607
SHA512 f2b1288952cdcd14b2937fb881fa055b944d5e0b9174806763da21f92299106b9fbbea49a8f7d5fb8da52e39840079e59f2904d0b608d468acf6d2071ecf1c48
SSDEEP 192:JoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup588ce2RUxCIsqEu:19iIxuERzA83h09RZxY56hru
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 05059510801aaaa08240a6b5e388bc86ba5753eadb71798881cd1adde1153128
MD5 faddb470c9e6a13cf14dc2408281add8
SHA1 1fb4b8eda769de7c5e1e7648024b214f386595cd
SHA512 5e144b9e303e15f671428fc1becb899a3c8c66cdf8c9077ba857e5bc205224e48f000ba60b765db7d33d209b65e3996eeec14c60884424e2317dced21bbb59f4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU8ee2RU6CsOHqRUx3GPOxJ:A9iIxuERzA83h09RZxYUjnRSFGmx8ohP
MD5 SHA1 SHA512 SSDEEP

Submit Download

AFF9.bat

Path C:\Users\Admin\AppData\Local\Temp\AFF7.tmp\AFF8.tmp\AFF9.bat
Size 122B
SHA256 4cbbc25f33818cf7a13976282f05f093091606701de1bcddeb37eb39613f7f3e
MD5 4e252c7d3f06bbff08a74b7a5ae4d566
SHA1 5af0ee7e8b8354b3dea0b913ba379650a6b5c5b7
SHA512 599b384d9ac75f50acef90a149b552b11e3d844451117003d2fdaaad9e6c7aa0d69619af6cfe0a4a1822df00208152bb83dd7c329ff1a4c4b399bcd77641dab4
MD5 SHA1 SHA512

Submit Download