Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe
Resource
win7-20240903-en
General
-
Target
104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe
-
Size
1.8MB
-
MD5
c4ecb069115fb3097aaff4a91dabc8e4
-
SHA1
bb10418a36aa237f6010e10e010e4f7e4d292cf3
-
SHA256
104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472
-
SHA512
958c6d375597597f2cbfd8e5f3f89286fe90641c5f5146c1b49f6c02f716f11a04669a4941da676b87bd628d5e251bd9e483c977c358c46a7a90fac429d6a1ac
-
SSDEEP
24576:/3vLRdVhZBK8NogWYO09QOGi9JbBodjwC/hR:/3d5ZQ1AxJ+
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
1.15.12.73:4567
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\N: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\U: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\X: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\Z: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\E: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\I: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\R: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\Y: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\K: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\P: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\Q: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\S: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\V: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\G: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\H: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\J: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\L: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\O: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\T: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\W: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\A: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe File opened (read-only) \??\B: 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3396 msedge.exe 3396 msedge.exe 3636 msedge.exe 3636 msedge.exe 420 identity_helper.exe 420 identity_helper.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 728 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe Token: SeDebugPrivilege 728 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe Token: SeDebugPrivilege 4804 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe Token: SeDebugPrivilege 4804 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 728 wrote to memory of 4804 728 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe 82 PID 728 wrote to memory of 4804 728 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe 82 PID 728 wrote to memory of 4804 728 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe 82 PID 4804 wrote to memory of 3636 4804 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe 83 PID 4804 wrote to memory of 3636 4804 104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe 83 PID 3636 wrote to memory of 1096 3636 msedge.exe 84 PID 3636 wrote to memory of 1096 3636 msedge.exe 84 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3820 3636 msedge.exe 85 PID 3636 wrote to memory of 3396 3636 msedge.exe 86 PID 3636 wrote to memory of 3396 3636 msedge.exe 86 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87 PID 3636 wrote to memory of 4916 3636 msedge.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe"C:\Users\Admin\AppData\Local\Temp\104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe"C:\Users\Admin\AppData\Local\Temp\104d56a1fbf8bfe0a1f9192084ad5c79741cbe977576c3a6ef050eb6ddf5a472.exe" Admin2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbb9746f8,0x7fffbb974708,0x7fffbb9747184⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:24⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:84⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:14⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:14⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:84⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:14⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:14⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:14⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:14⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:14⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:14⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:14⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:14⤵PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17363377202431121966,7141198757130441509,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3524 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3272
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
5KB
MD590a69f27ce53b5b8e33a707b3afa9e2f
SHA11b98a6146b5ab8325fe70a32de1b93cd3fd77366
SHA2563fb1c7936d7f07a8f672206e63a8ec56bc91819c133f3947110dd953e0ec1ffc
SHA5124271d3b63a2948ebfc72b4a71ec533296209559b2a0f4fe55305f62b700d1399785a1eb79d076643e8d653edb782a9c1728e6f05cd8f24d4bdfd4a249c972b78
-
Filesize
6KB
MD592841866448f708ce7d1562d5402df05
SHA1853f788b6a667a8d1d83c7cfbebcd65a1fb6843e
SHA256568daf16733b31199836726ae7a6fb64e32bf9db03134c1c1a951b75fb04b955
SHA51295ae77d27aa772fdc238124fc22af35129dcd5caf7abd7486dc8b183e20695bdda4faa76692a7ae68fe7c1e99fb3f0bc0584a31bbb27cf938b9f433ab0ac8e90
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5cce1e225db900367482024b57f79bade
SHA1e549093855b1344537935acf8dbd9257f40323c5
SHA256a225a84cc3af7d4817e08f10752075b7c03f3b9c46cd9610fbd25924724f0539
SHA512fc63828a5bcfba1a2608d89cb05cd86f13da320f751c24fbb998180a4913959faa911c30b615126d04bc4afe2bdf078f9d84db9170c2b5fd8b6b67a65e8973d0
-
Filesize
822B
MD503450e8ddb20859f242195450c19b8f1
SHA19698f8caf67c8853e14c8bf4933949f458c3044a
SHA2561bdd8f1dd7bd82b5b2313d8770dfe4f41cd3f45bbaeab8b8a7f75fc5e2d3720b
SHA51287371e57bf2296af5ec7f5db772a4ce66729d54aa23a8b384e3f4c42310b97b636576c7dff67c27a3b679339cdeee05b836563ae2a878f0367caf247b3e1ba7b