08975e2665243e02ad55dd53892d907554b297bc19ba2e4d11334eb67b45f3a6

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nezur_Interface.exe
Size

154KB
MD5

7e7adfc3bdd9b766fb15521dc6b00f25
SHA1

ad6abf2d4dc87ae133be0aa8f2e77dc098ae8f8a
SHA256

3e08f027849d86c17909b507b25df78521afe175bcf30424f70ccabbfdf7665f
SHA512

29b33965f5a0b095b3fe8c16c88015584c62067fe3d78da4e4ec131d42918450dbec71e63bf7ba8917c531a4adccf8c0badf8c043523d959d964186789c01fab
SSDEEP

3072:WAi4pxpEHmAdx4/kyHRZa0YiRAl278IVn2JbS1cJa8lWjfl:WAi4pxpRkyHRZa0Gl278IVNc0cWD

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
29	discord.com
30	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2437139445-1151884604-3026847218-1000\{7354F447-347C-467E-8764-F238ADFB6746}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
4420	msedge.exe
4420	msedge.exe
4388	msedge.exe
4388	msedge.exe
4544	msedge.exe
4544	msedge.exe
5852	identity_helper.exe
5852	identity_helper.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	Nezur_Interface.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4420	2684	Nezur_Interface.exe	86
PID 2684 wrote to memory of 4420	2684	Nezur_Interface.exe	86
PID 4420 wrote to memory of 3832	4420	msedge.exe	87
PID 4420 wrote to memory of 3832	4420	msedge.exe	87
PID 2684 wrote to memory of 4192	2684	Nezur_Interface.exe	88
PID 2684 wrote to memory of 4192	2684	Nezur_Interface.exe	88
PID 4192 wrote to memory of 1156	4192	msedge.exe	89
PID 4192 wrote to memory of 1156	4192	msedge.exe	89
PID 2684 wrote to memory of 4376	2684	Nezur_Interface.exe	90
PID 2684 wrote to memory of 4376	2684	Nezur_Interface.exe	90
PID 4376 wrote to memory of 2404	4376	msedge.exe	91
PID 4376 wrote to memory of 2404	4376	msedge.exe	91
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 1248	4420	msedge.exe	92
PID 4420 wrote to memory of 436	4420	msedge.exe	93
PID 4420 wrote to memory of 436	4420	msedge.exe	93
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94
PID 4420 wrote to memory of 3764	4420	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur_Interface.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://execkey.nezur.io/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d55246f8,0x7ff9d5524708,0x7ff9d5524718
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4632 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14247303213815375703,12719615960608278174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/nezur
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d55246f8,0x7ff9d5524708,0x7ff9d5524718
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,16859269082556959346,2288658068085113633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://1cheats.com/store/category/69-nezur-executor/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d55246f8,0x7ff9d5524708,0x7ff9d5524718
    3⤵
    PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0dee807c-fe18-4564-baa3-4901294ed169.tmp

Filesize
2KB

MD5
2572eb4d300ef8c207171ad5b799dd70

SHA1
ea682fdab79ae8d9a3bbe69aa8f618e9bee1e2ec

SHA256
e4ab3c325d11be88876e651e94a62dd7a06fa98a100a9b398b1f782b57ce3c4c

SHA512
89a3da0c67753c429d4deffeec14c9fed5b555cb96533d23950a24f081f9d90c84a5a323ac113e4ef54f81c1ea13a81e9dfd1973cd1bcb6c0f29b7ac3bd0385b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
f3fc5f3dbff50a91f1bcdfc78735a6ed

SHA1
825257ca9ba338f3ae175de4791cba1e1c21d7f0

SHA256
ab66ad5bfa3c3e62b744cbf253912f799a702dd396c480f169ec9e8326b2891c

SHA512
70c228ae63e0024e47a7718c6f9b9ab1aa0eda5a3d08275a563c76a9d7bdee5c0b948870294e68082780e467d8ccdac469ee241f6e9d7414a237fda5f6ffef28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d21e72ae066c622ccef788652fec2f71

SHA1
33904984576f701f815f5eec4a8092ed2bf2b263

SHA256
71f24642139e93f6709d3ada00a659b1cc7bb32223086e686e6c466193477aa6

SHA512
a6e7d9d1508051f0059d85b9f3746835e296bcb64291dea8535df5b079993cc722fa0f8d858a4786d8a41defed891d0619f8680a444cc2413c8b77ba5ecd4254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3849cd7dde11a59b697aa313967d0a7

SHA1
236826e8ca97b87fb20920b41de2bfa036ed25fc

SHA256
fa9a7e701275de0cd63aab49fe994b6fa2a3bfea645170f61c1d2412e189591a

SHA512
bc9c24711cc072b38ce0c6149f2494788e8dfd01b1db02bd9ca1977d01adb57deaada9fc7f9e04dd1ca12ba91d511854a183d63a84088c33dfd43a9fcd950d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
191db78eef3e3b64fb1bd22707df9266

SHA1
f1dd64724dd537a08b10f1763a3d34a2453dc4d0

SHA256
e1553c051a6e430bc18f649384e00f0b450652d03456d7b177a24ead5165db2a

SHA512
3c256701d25744c64805458dca3d14ba5a3341a3b981bc9fd7c5abb55200412027af4720fe8264d8166ab08da51a651f32288e4cf78f2d38cf16ae823ccac86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\327a1df9-59f8-4c75-9213-49bf9af988d8\index-dir\the-real-index

Filesize
72B

MD5
50973c597ee2adeda078423573cf5d84

SHA1
7e78e58a17780f3531157fb34a0c5434e4b7a6d3

SHA256
1bde4625809208dc603887cef3e2fa7013dd3a18b8e4dea0bd432cf0b84cc4ba

SHA512
accf7329b97295773e5ba743a8818b70b235e28866cf768f5cbef9cb6dde76dd9fff8cd375c103aedd40d271d7620b0dc976004adb5dbf87163b2baaf1590b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\327a1df9-59f8-4c75-9213-49bf9af988d8\index-dir\the-real-index~RFe58560a.TMP

Filesize
48B

MD5
ed7aa8e101b6efbef73c1eeb786c9f90

SHA1
31b953fb1a13a1356af2b2ff439c0deceb4e59bc

SHA256
8080f572a40ac9d98771aea303a7e58adad58e28750cc5fce4ce4756d85846e4

SHA512
5442b82ece65376dfb1ac1bcdb72ab712d089a651001fa9b56512f8372ae377e550784ebb0fd33259362791deafa6c06e6889b0f5a8757ba11699a8f611d5bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\index.txt

Filesize
116B

MD5
26a275169f6873503530a5d9c689189c

SHA1
60d2aeed64b96a2da524ee99f4fd39f5c03c5f47

SHA256
d1c25be8186203e5d56eabd187d22ed99e1c057f38542376e5a3cafe42cfef04

SHA512
2a5c9f1f1558e8d9dacb03dc4a9aff1e08c7af6d689a49e305f1243c96e81492991cb283caf50681f5a0e2c9bc9def79bb6867c881aeb536b342d2b6ca721eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\de63ff4275d236d5c1b83225b76d1c14d40b38a6\index.txt

Filesize
110B

MD5
e6772ab19ed1de5e16b11164f86f6c18

SHA1
f63ec2fd9b2a439cdc55b154196e5c7195c4938e

SHA256
91547df93c09f687c3c2d112da9b09bed75c19c749207f2d0a8ec1b1c15d08aa

SHA512
78478c69f74dda32c59a7c521c206e2bd3019814c23f807e2ceae530e37b74531e6e1da1c2bba3200c34f775f57207759b7791fd1877d52083e12172307c04bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7d48238c4cefdb83970f6a20651efd3c

SHA1
8a8c4fcfcdc4d2b10d14f04d21aea8c552c34f45

SHA256
b6c51e463835b836f2d059faba6e06b468ff67a3f4a0dc718cb9d7d78a861609

SHA512
b90b4fa2d155e2d45606daecd26df0844dfb18b891ca97c780a0ca1e29761427e8915c7c5f17162e3e19f0fa6ed42bef448ab91b047d14723191ac69d8a9d3fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5855db.TMP

Filesize
48B

MD5
32d440a4200588b7f37d88c675fa910d

SHA1
f4e378ece46a0e56b89e68eafc827089ec18df3a

SHA256
147ad234f2206ce14ce8ac92614e41c519e4767047e74180fbd7afdd136677a9

SHA512
c95a7fbde14709db7db1513d2a19fd61d61b4d9957f03a4e88ce8d400d279772cad589b934005a4e7f069d6f68222917fffbaa19fe03e1b3f98d1625bd550748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
da24fee7ec23d1e49f07626ff8c4da1c

SHA1
384fc7a598b2ea405b5bb3d36b7b0191f0e1f6ab

SHA256
da08af1a92daf0f29bf9fceb84db9117bec6a69172480ea97748540d668db1bb

SHA512
94a5cdc4388f90b940b1a9f5304d8dd65990ec65f780a3b0bd893d665d8f242a38dc4868bcc73300210dc050355531c16d7f5dc9fd24343da8609acc08a1dddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5817b9.TMP

Filesize
705B

MD5
d8285a44de74e2e9d7197e6a1aa888ab

SHA1
5831aa01564ec92fa913af15239b56535272f747

SHA256
77328fd61359ff6bdbadca6db6f099215e85ee35b85bc58f0a1b8463f064eda0

SHA512
238186353786c6995c2b540d096f9431c048bae23012274150708f5eb3b1726227d5f3268444bb1904757afcf80f59cd76734c39976c4dd6de5ce1f27900052f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
eebbe6eb7455d69d7fe371e2cbf9cb12

SHA1
bf407c3a498ed00922bb63bbd6831f6603f0f355

SHA256
7dbf49cc3cf60891a02f6f80a1746eabdc1b140ed8422fc5074f01cb17d0dfd2

SHA512
1d499c358f13874c9799c95f8ec6f8a1419c86b46dc86c6677c3cf3d5572306d8064de803b8b0ac54d5c8b87194b36cda36793e4067b0dd97a0b0faacd1d0014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
52551981803d8f766509edf570b2ae7f

SHA1
b2ba615b36911c4b8adaa15163d20d854396768c

SHA256
9312b3027468e7e293ae570d20fc3b04d676fc197f259754409d10cbfdbba3c4

SHA512
bfded7a463cfa0919469b91ffee44d9cdc6d6de15421cbfc1bff044b2ad033f94fbd98493e89ee8ebe732c4e6752e0b2743bb961145f9410f14d3c924a12a12a

Download Submit