hxxps://bit[.]ly/WANNACRYRANSOMWARE

Resubmissions

30-10-2024 13:10

241030-qemn6svqek 10

30-10-2024 13:08

241030-qdm9batfmg 8

Analysis

max time kernel
66s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/WANNACRYRANSOMWARE

Score

8^/10

discovery upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5552	NRVP.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
63	drive.google.com
64	drive.google.com

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023caa-254.dat	upx
behavioral1/memory/5552-267-0x00007FF642750000-0x00007FF64275C000-memory.dmp	upx
behavioral1/memory/5552-272-0x00007FF642750000-0x00007FF64275C000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	NRVP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\NRVP.exe = "11000"	NRVP.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 22694.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
4436	msedge.exe
4436	msedge.exe
1448	identity_helper.exe
1448	identity_helper.exe
5384	msedge.exe
5384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5552	NRVP.exe
5552	NRVP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 996	4436	msedge.exe	84
PID 4436 wrote to memory of 996	4436	msedge.exe	84
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 2376	4436	msedge.exe	86
PID 4436 wrote to memory of 1492	4436	msedge.exe	87
PID 4436 wrote to memory of 1492	4436	msedge.exe	87
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88
PID 4436 wrote to memory of 1220	4436	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bit.ly/WANNACRYRANSOMWARE
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3e8846f8,0x7ffa3e884708,0x7ffa3e884718
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384
- C:\Users\Admin\Downloads\NRVP.exe
  "C:\Users\Admin\Downloads\NRVP.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1192 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,10102443747239083681,13619618362250614682,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4b1fbb4833e69d2e1ffafd7d8adf39a7

SHA1
c270af647dd6b92275fdb9e5f74e84ece8d81572

SHA256
0648900a1ece8c992550e48bdd72da77ed0808ce411401291caafe590d577601

SHA512
17acf00db7a1a43b0950f1d8889d99c7da07e1b6c00edd8b82d1299273ac32bdcab4b44e319882cee054c32f47dcec330b9a5ddbf82622d10893262e0ba9e683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
927e7c4124189edac9384cfe22d5b04d

SHA1
3d736c07ab516c3acad79268fb97c8e00b2a20b7

SHA256
97283e8d08422384d3f99685246820ebfd59af574ddd838170af7f129b014328

SHA512
5ebc4227a8c780719de0b4f66fc9a28e56008c0cecc844d697a60938dc620ddcb0c0c8fa167b715bfecd2343eedfef27fe5963fc6a91857377f11019b5878c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02cc267a5f781743ef62a3a77be41f44

SHA1
6366c372c19a82252470474bacf3a5672dc3f9a9

SHA256
27cc9afaac282dd03b92286c4f13491eb8dbbd077effea6d09c620ba2e2960eb

SHA512
d8cb3ad312c441bcbfed9ca9a0ec7929e5e079015777cc0b3bb8ac176f4ab2ceb5577baa6ec12d4a07c8d2ab495336e69afc45bd82b9d0d1146a6eb59e94fc4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f272db0d3f98992f0a729799560b9df

SHA1
121458382b58e4a352d1437e2a69a7f14e402832

SHA256
735193ea61448b5d2a5870a58f7cc45283610db40e8488f6b6957a949311621b

SHA512
469326c0ce404f8bff8dcbd95a9dddaecc54e2cd292c69b87d4f1bb3445e4683234786b1e0a3f48bcb6cf87a5e6d2e095e667c2b04b2655c6a1a55af14d1a85f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca3280268a93db9b73b247f1fd493461

SHA1
0c8726a6db1cbfd6175de623441f4c11e17cbde1

SHA256
e9421d2b3d42bb26849e865125fd118472dac86682e5aeb972e4402908f6d939

SHA512
70a0af8d1c0487ae744129e4c0a7494f907c1d28aca347421e4e86a1727b97fa0d22d2fc154fa1ff0c650e0179a5bc7d111796777a513b520260047348fbe321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22b520dba93fc941d628a4fb031f30ee

SHA1
93c3f9352ba64ef6b183111e8e9dc5dc00dbc4bb

SHA256
993169550aaa8472045492b20796e5f67358e2f7be9646197c619a746324d7b6

SHA512
a96143dcf9d5c9fb89c0b4c79252b8d0a5e81544ab4462b16ad7c3fa7f55c900a6213b0a40d04dff5c85ca5c2516ef14f072d8af48f8c484f8a43f4bd5a93e35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25542fbdd8a0e73cf19a7281b56d8b8b

SHA1
98f52aba481a485915e357d639660f84f3526d49

SHA256
79ac26a5a19af7e847a2809e9c9d79bf6a1a5ec08158ec6b096fc37cbcb299b0

SHA512
a0c29b6da627de7f5efd2595883f2183054c6dac53ff445c66b03d4f0041f6b9b79d3fb2cbb069f104126af079a41d1c5e933610fb0d21932ab2110633676c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6e8526effc3c8a44f68fafd523d3c18

SHA1
8c3e0418b59ee49dcd73ee7d1af7b611366b4354

SHA256
b9cab9217eb511df3930dab8d31455899e0e400e15c5ca3740d3ad88dff2e321

SHA512
c540d1f9515403f90ad6cfdc7887d759af7d1511bd6f9616fd5c5fae54d7618253598f341c1fedb81d4e94327bce6c13adc9725f9be93a8601cf2dbd0e7e4016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df44.TMP

Filesize
874B

MD5
0d6179b4108cb47ab7cb789d6849e575

SHA1
8f1c8295abf2712258ccbad6d9ddd8d9993a2ef6

SHA256
05c8c3565be8a1816d2e4758771d33debfdd76d6512f4bcfb9694a8ea9d59638

SHA512
d958a2dad6975d6431e83a8a2d06e814b1df05151b3bb5f20b94ec1c56113780953e2eb3598907708559e3cf978a9eba58a76b1f2a88adc6d67818f9b9456b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1273d28cc7d3e467ddb28023ac892878

SHA1
338df9fffea6f0bf817582134722a8fa4edd3a9d

SHA256
01a9acb1ca0920263ccf61560506da76f5556343d4405dc732952bdc51a30a92

SHA512
accd8cc280b43b93fd44ea4dc28e62ddcf9b8dc258732979d7c5cc108d817a7f2b0c8b72997f083764a0d357e4ad2b47df7874ea27344f5eff1dc9a00e062d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a47d72c4d5c8a6d00c722712f7f6362b

SHA1
82650cac17a484b26bcc778bb17f592f713e6053

SHA256
061883be2fb5bc8f598c08bf26f747c58957c877b00ba463fd23e57f0c75dd66

SHA512
7a75308f08a16df518ce90aa33589d2ace0f609fb4f0bcf1ab5061ec37c3df94cd0aad9e85c8e9d19c2e7b23d8ece3e371489719fa83b1a80d71daf626e2569a

Download Submit
C:\Users\Admin\Downloads\NRVP.exe

Filesize
9KB

MD5
f7349874043c175bee2d0ff66438cbf0

SHA1
da371495289e25e92ad5d73dff6f29beea422427

SHA256
f852b9baeeefde61a20e5de4751b978594a9bf3b34514bc652d01224ee76da1b

SHA512
878f4bc1ab1b84b993725bcf2e98b1b9dcb72f75a20e34287d13016cc72f1df0334ac630aa8604a3d25b9569be2541c8f18f4f644f5f31ff31dd2d3fedd6d1ad

Download Submit
memory/5552-272-0x00007FF642750000-0x00007FF64275C000-memory.dmp

Filesize
48KB

Download
memory/5552-267-0x00007FF642750000-0x00007FF64275C000-memory.dmp

Filesize
48KB

Download