c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

Resubmissions

02-11-2024 14:56

241102-sbdm7sxcqb 10

02-11-2024 14:48

241102-r6mzpaxdrp 10

Analysis

max time kernel
1738s
max time network
1747s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

release (1).zip
Size

445KB
MD5

06a4fcd5eb3a39d7f50a0709de9900db
SHA1

50d089e915f69313a5187569cda4e6dec2d55ca7
SHA256

c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
SHA512

75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
SSDEEP

12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4348	builder.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
75	pastebin.com
78	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2360	msedge.exe
2360	msedge.exe
4200	msedge.exe
4200	msedge.exe
2156	identity_helper.exe
2156	identity_helper.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4364	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4364	7zFM.exe
Token: 35	4364	7zFM.exe
Token: SeSecurityPrivilege	4364	7zFM.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4364	7zFM.exe
4364	7zFM.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4608	4200	msedge.exe	107
PID 4200 wrote to memory of 4608	4200	msedge.exe	107
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 3600	4200	msedge.exe	108
PID 4200 wrote to memory of 2360	4200	msedge.exe	109
PID 4200 wrote to memory of 2360	4200	msedge.exe	109
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110
PID 4200 wrote to memory of 1592	4200	msedge.exe	110

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\release (1).zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4364

C:\Users\Admin\Desktop\builder.exe
"C:\Users\Admin\Desktop\builder.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa370a46f8,0x7ffa370a4708,0x7ffa370a4718
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4945875755354538354,16047782306273947269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3561dff07548f39cbc56715b0c794aa6

SHA1
5d050389453c971f7906045f526bdf8de1b19e05

SHA256
2db23808319c42d81026cb503d97528bc2ae5484381ca9ed3632dcb0e8bf0a38

SHA512
b6ceb79a5cdccfc74f3ce68a703b62ec9c37adf7531bf2b2e990b6e017b5c2ef6fbdf37aff66a964bc272b30fc1c099358150f431904f70ae64113cdd7ab391a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
e20d0c7b5dbf305c611a16991d0b84da

SHA1
663faddd3dd355d93892dcb8f11f2f8d4533719d

SHA256
f709abe318e96b6a4babad9aa8ba69e4efa17b21083faa7c98bc744a487f15ef

SHA512
7af7c22ae7c844ffce648c8be7ff4b55d19a25481a87d2b045d9856fdbdf1fb2acdf0c0644eeb54552d77cde9f75bd9727c1d48c3952ab911dc9b5b459863211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
b84ac118dafab88dec1906eff88c4010

SHA1
123907f80fbebef9ee4c36b14981b2bf3976ffea

SHA256
ec84245a44bf0a1426bdc9ebbe02efa79216478282799e58671dc6822293b83a

SHA512
9898a235ec744988f75d21c068cf6442cacb3a9559bbb7d8b4a7d42d54638427bb412d04858eac34c504e34330f2c4a4e38b674777d41caaf9e71bc1537716e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
6cac73108430c57fafcd0dd59c08852d

SHA1
9825f8d2ff9460ef3bc9067eb018c0e259cf417a

SHA256
dfb581624e51ca6a39b1636b1bd67eab4ebd257b4c155e8dd3d8badb2786f4e7

SHA512
b7426a296ad208ef342a3bb8f8570c9442cb59cc1505e5363dffdd34bbfec234af52ed499bdfcf2b2de9306387fe61f7cfd956610b97965180bbe0f8bc659795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
32dc84e64b77f7fca50d155712d72acb

SHA1
2d053e2c6ac04d22ac3dba43e4759ed96db369a6

SHA256
c6166ad91805fc6fd9636bde23955609a243d12f9cefeab6356699902536bc60

SHA512
4a47ac9d9010b1726ec7a277d4a6101e19185425fb5be0c039f570078a70a6a10ff76f97335288ae8ba6e362dcc6ee873bdce539eb8bf5c0a4a4515e4e2fe1f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
f62dd075456b5a2a2b52ced67cb6ecee

SHA1
1ca5b2386c8c62c8900625e0dd41be2028346163

SHA256
e595dfbd00da977092badc0831216766a933cc5433817c4447961b2c886a3fd0

SHA512
8f45f2f4b6d0c5277338ac49269c2aadc059f665d61d9ac72b440f5a604a8b77a6f81c14739cbec3febe7e37eba6d77457836bb2d57054f4201d22a247087c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ad595512607fbd72d82acf94679b3a2f

SHA1
2145ee8f6a2f71ed0f1a1f62525d7bcbcfa8e7f7

SHA256
de9f17c5d8e2f6571e5a30918b4dcd8c43829b3ee1a5dedf4ee5d9539b0899c3

SHA512
8c3c4e4371113876c9b268f6c10b3c17fd793ed14bf2f775e0d6983ec52555492d1fb85ac9a738ae4df8cc8294285e916925f30a649fb8f9e1d9d38b09085c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f747eaa2135676a5313c4bb563dc890

SHA1
605c25958cb44924ee23b2f657aa85757d72e32f

SHA256
eb8ecff783d0d25302c773cfc484cc4bb199f22da7c0c89f28a4699440e54b6e

SHA512
e69beb3d31df821d2e5c57477686a9a7aa412abc366750c8911464309a5d9bda4b678099e9ee32af2d42124cda2f5b54b1b2a809221708fb10f005bbc40b0d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6c22754f8edd397259822b1eb4460a8a

SHA1
f294b3e19d89e9ed9e9b6ca2ed08fe42410234a5

SHA256
8ada06fb801492e3d36f0a2d0c0982466039ac6e448725ba01c128afb7ea2180

SHA512
856eb9f9690df4f1d1eaa37a2f1c3611feacaead052515b166b5dccac64aadd782fd0c0966ad4b434b0cd31ea1a35b12fc023b0ff20ab35f13b8ac84becdfb8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59dfc7.TMP

Filesize
48B

MD5
ffe33f6dfb94537f087e937420ac8881

SHA1
d048b5ded777522b4e3c58f80c0797df3f93dc9d

SHA256
a6d2b45a099c7b75ec8c43106c43407aa7b00582a57d4d568d006f2a252fd878

SHA512
064a5c0542f6764c2c27a18fdbfcd8d01757014e09a624b3deabd681572c9f8af40e45a6722c096773c0820dd3430bff381fcc6051e8987cf912cd00fb941877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
4398ad1fc338ced087e6f464474dea30

SHA1
20bf3998fe943adab9052f003f5caeb4d35d2e97

SHA256
b720c8b7f686af523068773a8fdf15224198b647f192e29e23d9c2ba7da4cd50

SHA512
cf88efc91c838afb77d5932ecdd61004baf35d70ae94f797a10592b599690c1ebf4dd3942874f09af87a7d948c1cc71d8c776627e43c689f61c2bba602ee5fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d9db38ffc5e7e50d69814465b6cb5055

SHA1
f7baa83558b7902d9d67be0723bd00e570f96490

SHA256
866c99142c29463237a6d27a32c3811473651e5cd5e8d55ce495ffb927671d57

SHA512
7a73b0aa09f90a3cd19d6c3c4b3ac8b0bca02d997803d525a146aa30cf4577cf1e1246eab87f74f8c7909e80cad1626eb8207d7b841a9f08ca598df659b53843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
932ca120d4616dc15f0c45e40db8c07e

SHA1
21dd32321afe4e78db017518330da7bd44be224f

SHA256
b153e5927ccae6625adbd9da81a09de129ce76e01e00d72df2c1f4e001ae04aa

SHA512
0a48776c3574438d366833debf487719a87fd05ede0a7ba331f36fec2588b4b4a817f01e10b8b646d12a7d97a94af0c8f5b6381f8524c336dc9c4014eee6f284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5975e2.TMP

Filesize
1KB

MD5
e7cc17b668170808ad2a604fca10ead6

SHA1
38ed5d70e0a13a32ac6fd20a31701b03ce063b31

SHA256
681fdc4634648f729b0bf33d931f9df3b34876a5e09cc38d0cf719fdf695640b

SHA512
ab7c02e5f8dbbaec4d5e966e9133a08615649c2c2acb47eceb36feb525fd49b2c7f69afdd7963265025f4dacf8ace448311cf46cd5ec6bb70d8a16ad1e3a9cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d314cd8037a6e93be521a99c2dda7507

SHA1
fb34e4460b2c4ac1e6c30aad5667ae5ca16e31fd

SHA256
764538bd5fcf3912ba42efdf2d5d97ec6d870c453a6f7e3871317ff57a04a8bb

SHA512
b8f31574a4341465bf008b0b2ca1b72b1607ed32470a283e10ee191fb40dbe63b109c36e062348996ee38df56b180e10b68c4b14d14deace07fffc88b26099ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f105c43c0e523d0e583d964bdf720c59

SHA1
eb458c1d2632f55b0db1c27db4ac5bf9ddc8168d

SHA256
562cf5c5d8c8767b87ae65253ee7ea182be85fef4faca31d3c0b85a197e8851f

SHA512
8f91fc939720484a71982570abcb397e4ecdd8a39fd24617893409bfc2d45d6f0444112f3cfa8be65cca256f2719c295d8f86d3cc23cda4292647ecd8e25b990

Download Submit
C:\Users\Admin\Desktop\builder.exe

Filesize
10KB

MD5
4f04f0e1ff050abf6f1696be1e8bb039

SHA1
bebf3088fff4595bfb53aea6af11741946bbd9ce

SHA256
ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa

SHA512
94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12

Download Submit
memory/4348-15-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/4348-14-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

Filesize
4KB

Download
memory/4348-13-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/4348-12-0x0000000004F80000-0x0000000004F8A000-memory.dmp

Filesize
40KB

Download
memory/4348-11-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/4348-10-0x00000000055E0000-0x0000000005B84000-memory.dmp

Filesize
5.6MB

Download
memory/4348-9-0x00000000005C0000-0x00000000005C8000-memory.dmp

Filesize
32KB

Download
memory/4348-8-0x0000000074AAE000-0x0000000074AAF000-memory.dmp

Filesize
4KB

Download