hxxps://drive[.]google[.]com/file/d/1ylSw1pvV-PPZ5pFYY5F8EGwStwPNdPUc/view

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1ylSw1pvV-PPZ5pFYY5F8EGwStwPNdPUc/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
11	drive.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe
1692	msedge.exe
1692	msedge.exe
3780	identity_helper.exe
3780	identity_helper.exe
1616	msedge.exe
1616	msedge.exe
4984	mspaint.exe
4984	mspaint.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
184	OpenWith.exe
6112	OpenWith.exe
3936	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
184	OpenWith.exe
5820	OpenWith.exe
5992	OpenWith.exe
6056	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1960	1692	msedge.exe	83
PID 1692 wrote to memory of 1960	1692	msedge.exe	83
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 2852	1692	msedge.exe	84
PID 1692 wrote to memory of 3728	1692	msedge.exe	85
PID 1692 wrote to memory of 3728	1692	msedge.exe	85
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86
PID 1692 wrote to memory of 1996	1692	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1ylSw1pvV-PPZ5pFYY5F8EGwStwPNdPUc/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5a9546f8,0x7fff5a954708,0x7fff5a954718
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,10807597321844563848,9407065883767882958,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:6112
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Microsoft.MSPaint_2024.2405.19017.0_neutral___8wekyb3d8bbwe.AppxBundle"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:2724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
c8badb7cce5322b6772bddef3b8d0b71

SHA1
f2c6255c15115661b00a518a2744e94f589aeffd

SHA256
3089ac0b53d0938a5f17e542db4d12e4f3cc55574f993443913b10f797727b73

SHA512
0e2b04bd72c56233ad0226f24cb6089c1519aad16a03b13de6638b35a414409d2c9631dea7e91690521d06efe3ce524353cf7c379dec8519a1c5559214c9e222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
402c2b244c5ce2aabe5676171c01db11

SHA1
a66d7afa4b284f4354e2152e2bbd5a4dfc3ccecc

SHA256
24c273acab126b277febbaaec990a4c9fdc6bf92b299346a2b762644373ec962

SHA512
f53798fc8d52da8b8a92331b9c7daad610532bdc4f2edc17762eb5970df35d2f03750e0596b997b8995dc0a5b9689bc635da7e486d351cb01fab28a245fd8402

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f013dc70f7fda4f1c73abb06b33cefc3

SHA1
405bff2ac3a5ea0015c9cb0017f0fc26383596b3

SHA256
a687dca4f6645f78ec903a8d5e5446515973b50724a90d20f9105eb6a2eea75f

SHA512
30522d29c2dbaec0e0682db1716bec55cf0fd2a61fd28c5bed2117e586ed8c5276da020589b3249965abd77681df7cc709b3e7fd2c5ac164315408e149a8f58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e167973b15c25aac5b240ff71130282

SHA1
d57beebd6cd0b0e24238af958bf2cb803a1253a4

SHA256
dba4b9d21e87a4be388561ff1222a1bc7e0fa89f43f6d1bddae9f2b3dba45426

SHA512
5bbde0c1e1943064657bd5bc883f7a306523ebf5d7b118c21a185b9a3db8bb58215296812b959cbf632b3a6fbfa159a7f1a9f5dfd2b3ae3ed81efc3a5ebc337d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc7e0d57768886a844de4c92da25c18b

SHA1
c853b3c9f3106e99cef442069adede3813dd23c7

SHA256
f4ce93e20e751de9a5b255f0122424047eddd1a792126ec20c054467fc61403b

SHA512
8ac5d78274478321cd26c4b424f72c6c474ea46021987de94ba997bfb5cb83b6fffa96eff2149b9f22bc1e96350eb32e46f2c3f9e60e717944ad871fb2d18ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9973845f48cf5a059039ba5218733e3

SHA1
b69f42b26dc2af67e923ae482028b3e7adc58c54

SHA256
0dd38c3deee1fd18f6e7c2109bd5ed16cb951fdbbd5309afa48b3f6a5ecb0722

SHA512
b075977e334500cf5b9f60086bc9f49e7f94602555e93150a586974f7f1f329437bfae83099ac0304883a1f0592acc9d9b9a60c9e961b61539c97ffe470f34f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7645dfd5b5be957c36c3a5388bd38854

SHA1
4f260719a6cc682c7b94da32e39edee0bb2bc28c

SHA256
f19bbf320a144f9aae431c1df1b0737b96582a4c8b954913b49f000c0b9cba68

SHA512
5832dc962e8b77374ef5df009048b93d13fe1d703791f731c45f8125c0a8086d7331290bd95b8fdc8f5dd6d139e9a8a3a766252b43965ebf106604f11945627d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6ce25d6f0d170e7029dd72eb6605dc56

SHA1
b9a132fc2889231976429a880de05ac4ffe23a01

SHA256
7cf5a973c8cd7d81e423b5288d1a8c71839a9cd6598e5ee38ff3c26ad5f4e153

SHA512
fefb90d8bb58ff0569596ecc2fc00ccae9b4604fbc21c1344333a259cf6e210cc1e3b4b91868ab5405b2082c50535005409df8bed9885da277296a4d13d302e5

Download Submit