Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Ryzen DRAM...cy.exe
windows7-x64
1Ryzen DRAM...cy.exe
windows10-2004-x64
1Ryzen DRAM...er.dll
windows7-x64
1Ryzen DRAM...er.dll
windows10-2004-x64
1Ryzen DRAM...cy.exe
windows7-x64
1Ryzen DRAM...cy.exe
windows10-2004-x64
1Ryzen DRAM...ed.exe
windows7-x64
1Ryzen DRAM...ed.exe
windows10-2004-x64
1Ryzen DRAM...rk.dll
windows7-x64
1Ryzen DRAM...rk.dll
windows10-2004-x64
1Ryzen DRAM...cy.exe
windows7-x64
1Ryzen DRAM...cy.exe
windows10-2004-x64
1Ryzen DRAM....3.exe
windows7-x64
10Ryzen DRAM....3.exe
windows10-2004-x64
10Ryzen DRAM...g0.dll
windows7-x64
3Ryzen DRAM...g0.dll
windows10-2004-x64
3Ryzen DRAM...g0.sys
windows7-x64
1Ryzen DRAM...g0.sys
windows10-2004-x64
1Ryzen DRAM...64.dll
windows7-x64
1Ryzen DRAM...64.dll
windows10-2004-x64
1Ryzen DRAM...64.sys
windows7-x64
1Ryzen DRAM...64.sys
windows10-2004-x64
1Ryzen DRAM...st.exe
windows7-x64
3Ryzen DRAM...st.exe
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2024, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
Ryzen DRAM Calculator 1.7.3/CCXLatency.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Ryzen DRAM Calculator 1.7.3/CCXLatency.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ryzen DRAM Calculator 1.7.3/HCIMemTestController.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Ryzen DRAM Calculator 1.7.3/HCIMemTestController.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Ryzen DRAM Calculator 1.7.3/LineLatency.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Ryzen DRAM Calculator 1.7.3/LineLatency.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ryzen DRAM Calculator 1.7.3/MemSpeed.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Ryzen DRAM Calculator 1.7.3/MemSpeed.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Ryzen DRAM Calculator 1.7.3/MetroFramework.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral10
Sample
Ryzen DRAM Calculator 1.7.3/MetroFramework.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ryzen DRAM Calculator 1.7.3/RandomLatency.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Ryzen DRAM Calculator 1.7.3/RandomLatency.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ryzen DRAM Calculator 1.7.3/Ryzen DRAM Calculator 1.7.3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Ryzen DRAM Calculator 1.7.3/Ryzen DRAM Calculator 1.7.3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.sys
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.sys
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Ryzen DRAM Calculator 1.7.3/memtest.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Ryzen DRAM Calculator 1.7.3/memtest.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Ryzen DRAM Calculator 1.7.3/memtest.exe
-
Size
40KB
-
MD5
2da23869191b9b93106967d1924e6342
-
SHA1
ef072f822fa270026c7243e8ad4cf5fccccf2947
-
SHA256
637d81054008795d8ba5115682fe5979e26c3691d3a8ac7960bdf1a69436907e
-
SHA512
80a8560304f08e1ee7c77de19d100aab00e8932147507486d6f4558760459a57633f013e907b93263fc41c158ef0a4b061708d036165d9668ba90405de3ecf27
-
SSDEEP
384:YJDsy4wiAjbceYC87TfUjO1RMuQJL3LNQu/+Hqo71a1soaxFWHxujgHjKDuucNzT:YalvAjbceg7zlc9bGC+Hq+2/aGHF4M
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3028 4824 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language memtest.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 36 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1516 msedge.exe 1516 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeCreateGlobalPrivilege 2964 dwm.exe Token: SeChangeNotifyPrivilege 2964 dwm.exe Token: 33 2964 dwm.exe Token: SeIncBasePriorityPrivilege 2964 dwm.exe Token: SeCreateGlobalPrivilege 2620 dwm.exe Token: SeChangeNotifyPrivilege 2620 dwm.exe Token: 33 2620 dwm.exe Token: SeIncBasePriorityPrivilege 2620 dwm.exe Token: SeShutdownPrivilege 2620 dwm.exe Token: SeCreatePagefilePrivilege 2620 dwm.exe Token: SeShutdownPrivilege 2620 dwm.exe Token: SeCreatePagefilePrivilege 2620 dwm.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4824 memtest.exe 4824 memtest.exe 4824 memtest.exe 4824 memtest.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 3260 4824 memtest.exe 100 PID 4824 wrote to memory of 3260 4824 memtest.exe 100 PID 3260 wrote to memory of 4644 3260 msedge.exe 101 PID 3260 wrote to memory of 4644 3260 msedge.exe 101 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1180 3260 msedge.exe 102 PID 3260 wrote to memory of 1516 3260 msedge.exe 103 PID 3260 wrote to memory of 1516 3260 msedge.exe 103 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104 PID 3260 wrote to memory of 2872 3260 msedge.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\memtest.exe"C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\memtest.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hcidesign.com/memtest/copyError.html/ver:6.0%20flag:4%20xy:02⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec67246f8,0x7ffec6724708,0x7ffec67247183⤵PID:4644
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4644 -s 6604⤵PID:1992
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,17995888829446636488,9022499630356164171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:23⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,17995888829446636488,9022499630356164171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,17995888829446636488,9022499630356164171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:83⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17995888829446636488,9022499630356164171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:13⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,17995888829446636488,9022499630356164171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:13⤵PID:4640
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 11122⤵
- Program crash
PID:3028
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1632
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
5KB
MD5c811d02b05895949c79e982051b952d0
SHA144e04edb153d66c09d8c09c3cdb65c9dbfb71961
SHA25621b5ce35e200205bba7dbe4882f6e7d26868e7d5c5d0c659aa727a8faf508003
SHA512da766e3536c700c95d67f7d340b7335d1c8d15e1f1af8ed94a781e265d8e692a1a2259c13102bd1c92bec7f2772af21fd62147c458be509f21bfcd5a7d9ca724