hxxps://wetransfer[.]com/downloads/75f2a6310f58b08b63241842bd8944e620241203191706/8cb1c1fff5c2a546505fc470777f5c9120241203191707/2f27a0?t_exp=1733512626&t_lsid=35f96c30-8840-466c-88bd-3efd4bff64a7&t_network=email&t_rid=YXV0aDB8NjcyM2RhY2M3MTQ1NGYzMTQ1YTRkN2I0&t_s=download_link&t_ts=1733253427&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01

Resubmissions

03-12-2024 20:23

241203-y6mr9asmet 7

03-12-2024 20:20

241203-y4fk6aslet 7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wetransfer.com/downloads/75f2a6310f58b08b63241842bd8944e620241203191706/8cb1c1fff5c2a546505fc470777f5c9120241203191707/2f27a0?t_exp=1733512626&t_lsid=35f96c30-8840-466c-88bd-3efd4bff64a7&t_network=email&t_rid=YXV0aDB8NjcyM2RhY2M3MTQ1NGYzMTQ1YTRkN2I0&t_s=download_link&t_ts=1733253427&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
1288	msedge.exe
1288	msedge.exe
1912	identity_helper.exe
1912	identity_helper.exe
2136	msedge.exe
2136	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4828	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	924	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	924	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe
4828	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 4856	1288	msedge.exe	83
PID 1288 wrote to memory of 4856	1288	msedge.exe	83
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 1044	1288	msedge.exe	84
PID 1288 wrote to memory of 2720	1288	msedge.exe	85
PID 1288 wrote to memory of 2720	1288	msedge.exe	85
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86
PID 1288 wrote to memory of 3064	1288	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://wetransfer.com/downloads/75f2a6310f58b08b63241842bd8944e620241203191706/8cb1c1fff5c2a546505fc470777f5c9120241203191707/2f27a0?t_exp=1733512626&t_lsid=35f96c30-8840-466c-88bd-3efd4bff64a7&t_network=email&t_rid=YXV0aDB8NjcyM2RhY2M3MTQ1NGYzMTQ1YTRkN2I0&t_s=download_link&t_ts=1733253427&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeca0746f8,0x7ffeca074708,0x7ffeca074718
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,15496118758128598881,5498692932080157317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x4d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4284

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4828
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Data Specs and Company Info.html
  2⤵
  PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Data Specs and Company Info.html
1⤵
PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0xfc,0x7ffeca0746f8,0x7ffeca074708,0x7ffeca074718
  2⤵
  PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

Filesize
1024KB

MD5
c14c96873ba0e7effe6a961e7eed92cf

SHA1
d53b7403fca2d43b4be83ace29afbc623d0962c1

SHA256
25d5f51eda6f1f4d340bc97f80ac178ee0491df3279ed98dd4a3ff0d6a90b49d

SHA512
0a08ded1390fb3b5305f0eb8284f2e8041a76125a055a84e6e29552e70b12851fdba0c04061116c8ae30a5afe102708c986dc188aab436b487e44953fd681480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
640KB

MD5
2658cefe2287592c3378a9a7244027c9

SHA1
4c98f865fcdb0a1334659b01cfdc470cc9108c93

SHA256
35ddce449bc1661801f0f961cfde2bcd74c5c6a47d431f964222ca2ad7159565

SHA512
8525b727d078b748086c18ddef535817f22743f864464a30c952befe6399302b692c139579108065705d798192eab1d7ab51b0018c0fab119092c066eaf2cb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
948ff082e0fb98ebf86aab8acd86151e

SHA1
fbfa48283324ecde73d1b0704e36b9022e17d1ee

SHA256
91938ffde141ef3e10ef1062abd057751ecaabe20244d7b775e10d4714f9bcba

SHA512
eb22276a201199ab5b74fc19d7b73bdf3d9c7a999f8db5b7b86aa1f4ba995c741caf3f5bd3056bea70a49b19ee4e77d5e1c5a69bd94d154c5cddaa6d1c30cc23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1d0a111c3de56fe859e45f1e2078bc64

SHA1
b8f5b5f493f832b6f329f4d2ba1971b573882e33

SHA256
2d41bb9bc5ab7f3d0e3378ce9e42a5fc7b7b070869bb4c0339b7417cc03d2e51

SHA512
e14183a25d76085453a0326cb4f39f41253c363b8598c5c9fed063130c8f73c5e7de0e5435f33edda995cc6c26a47df504d78bced525093def324b00072bee12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1e0d5c563cd30ffb5415d5c136624663

SHA1
386e16ffce6b0c5e1bd7a2c1ec8d9cbecb28c688

SHA256
1a9650f78eafe44145a52b3430de040b1a5c08b4fa3cb52094fb0e083daa8ede

SHA512
2bf9a1616b7710328b162c39bf824a0e69e5b354a83d2a0905bf70314222773aa8ee7e6b00690caf6d27d5a0863a356f7c897cb93498774916ca4a0e152431bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
c4d7db2e5086dd01d7445f7b62544178

SHA1
836fc8d14e2d873f5b82dfaf5ac4e8d462386f3c

SHA256
8b08ee47d06a7ac4f442d1805681cb7541d6eaa52166e9f27e4f33a4ba039fe2

SHA512
ee1f405c5eb9b6b40eee1d034eda25f6d0ff260d327e79d2335a94b3d253b701096487da3cc400f2f22d7241afb0cb844df5a6e6be17729ae1969451433fbc1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1055604f2bf1f7a485806d11b8f439f7

SHA1
13a5cbc29783ed40dcf9702624e3cb58ed854932

SHA256
74f23c04c578e23b35f9ed3e127d52e35d662a482e613b522c8dc87734fd9fe3

SHA512
d97fb542588a30e0cd3a9fc5112e500b01d645beed819ee0de46a4f53a74d105766ec4d62cf7b7feb51f8c61a76145b03548a74c738dd42f00d3c3480a684677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3082ad351d240ceb77fc705604ae5f3e

SHA1
9f085b878b27fd8afbce0f7c1565f96113438841

SHA256
2a55dce6fcf33e0a08418eaef08119153c4e4e4e3599a1f7e403fd665e25e114

SHA512
786718dd799c3c7434fa057c04b8ece17fc2af486380064e9d715ca0daa607309f59bc6778c1cefa4fae2cf4f806cb2fca471a2b17521b6e71eb9755fd45853b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0648db06d435a31dfe6b89d2dc495b8

SHA1
a0cff64e37dce94200c48a00bde01e5505c26d3e

SHA256
11803a22c8a8fa4db0f1b8eb81de19dfa70b14ae95ab49d36695d78866eee896

SHA512
b5a45bf3562953e987077b3e69881341f1104c7db8f361a4bb70e3bc283020fc15296d0d5294ae122d8db539b5359bc7c17da68ecea58f035ccf9544d63858c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62db759f45ad287ea90fb345aa532080

SHA1
de4114a54baac288b1211dc52238bfbb7167d6e7

SHA256
123c320ab0a44141eb8c3be5c614cbd897b401413026d6d82e4e56f58309c790

SHA512
13b16633b8bbf8500b49a9373c3dbed980fb7f47d6da3d3b8c13343ba9a33a201a72a5b0ec33ec77970da929a94185445e481705e442cec7c0512fbc2c3c68f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
301539b97f096036129231a7f589161b

SHA1
148bc0a34b2ca1b4037c065e7e804bdb3e5c0839

SHA256
0b5a45442ec0835465bb31f1229f9de419074d5fccb9f0b61c3b4a5bf9fbae08

SHA512
9f344a6ac9fe184ab1b16772422994745b597de9e3a063b5857175fb4ec36c9ece4aa83d9abd54450a718fef72894735581a422dd3e586f1036b30a9cb825244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f245c7af5efa656c2a613dc3c5ff5ba

SHA1
3ab79d970fe6867890f6f8be753c6eb5500c5ba6

SHA256
d124fabc909240c35401e210e35a23c69786a82efb8a2d6c0ed71c5c170b85bd

SHA512
1dc118b3f001eeb1862cc6a23d6ef2a3151e15c8f6af906fb52c4c456df59743acb17524ccd6902c0a002be66b195e277447b420dcc7c15deb8738ed1af34d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a2cc027c3a440624fbe668a0a6dfd5c

SHA1
a9b1c41ef81f03710499f56310a10206d0c46714

SHA256
2160aab0c46bf91221ed60bd361fc2a254afcf7aa94d2885fa208a720c196609

SHA512
1bad55a4b6afa369867167c0058d2464a511645238140db0d41474fc9a9f0575d08749b3df71dd8f2a8cd78515eda14b8e0b9de1125592f781a79181104ade20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
f4bb27b4e3550e23f9b137f0b514a783

SHA1
2b75a97da01a2fe5376c3f7727654fd0bdb101a5

SHA256
55d73d068f03a1a123f45bb2b478c7193ee67ff9caf40d73a45638e2e95c9243

SHA512
bddd4794f4a6c74cb50465cd6079e768d621f3027d0245e974f2b150c3ebfc7a092f26ba2857227021fa84585d231530ac3af73f57f015254e8c38482d7c354d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
703B

MD5
f84517e6ac2980e0e8e2324a27a2865b

SHA1
2b3d1cdbb8d695efcd6619fd7f5f97ee641f5388

SHA256
923348d974ba5bffdfebd5d1a5eded713ef3179fbfb2f62b46e839ecbfe7a861

SHA512
eec366815cb7219cdb8772c7a23780419cacf4abfbfdc7d1a31469184c0e2f48757fb24893abf56ce97cbe0139f801907e5c05955f697a4aff3036873821a633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
5a601ff09e27b3e611f8a3cb6653cd02

SHA1
38e9bfc9466339d935e357122e77cb771e461d99

SHA256
66045c4cf22d6ac67bbcef2e48c63ebeebc8898b842cc5913a36ccb6872fa5ff

SHA512
08b8dcffff8e7f0b4437e98bcf9cc3fc1b916178eb8adbdf49ae6c994470c22ffbddee7ba4fa7cb36b24978f494202082f69de826c9d57c5c45f9c10fc4caa74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ac6.TMP

Filesize
705B

MD5
ead4050e646b01e4ecbbfe42200f1937

SHA1
66704d5688ca1243317c7046e5181121d5b70fba

SHA256
ec4a32fbbad57405a1a534999a05b088a8f7d88a933e781af2dc9cf571fdb0c4

SHA512
343f2e5035d1e9673c8df120ac15307ab43117fa4c74eb2b04fde88ae738b2cdd8305a29797038a921b01cb189475d4589d3b8cde96d7ccbb8e0aa797b9fde88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8931a86b0afa87f60ad11448afa978a3

SHA1
b4d787650cb2b966f61d5cb1b64e2cfee36978e9

SHA256
fbdfc5da5dc274094c0b2dcdbd7a4c3fc8bdeff70e72cfe6075129163f07547e

SHA512
0f8e4b364686aee204b95a2a2bcca5cd8432310287f1e0e999053b7721d97a90608a32b022d8efd0e53ea3ddbf6f5e67a751fee5f0518ed79cea74484a5ff90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
69e30966b526b6f095a009e15d7e4967

SHA1
1c0f8ad18d67cf5c489993fc602f1e68af89eef2

SHA256
870644868c4c6a0508b4fee3203c6a66ddb331d737e94675e68f879a2c4228d2

SHA512
627fea4a5557cb2b020b31261a1895e54d0d63fb9e77daa46bb900d67016e7763d3e63cde207199495903e8aa73f587abdf8db5759eb409690499bd3df8e371d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff66d7f3cd9ce2a01348753391f1771b

SHA1
9e88b4579f57e4c6ba2926813b49fcc0bb5945be

SHA256
a7d1b57333d1f2226859f64a957dd46c8c5187b2430b506e31aa6bb40999b93f

SHA512
c469032e634c1cc0ca392060da5b09aec057b034e45fb29db7f7e534aa536afa51840a45c0ac6fe2c4b4c02e61c97d5721255d8dddefd37301c6fdff4be6aa2a

Download Submit
C:\Users\Admin\Downloads\Data Specs and Company Info.html

Filesize
83KB

MD5
c3ce3587f379277bc16c69cdb8598b38

SHA1
e0ba01df132258f5bc8e07b46775847945b38cd9

SHA256
b8516c5f7b348c5c0c9d90f675eff1e926c5cc6e34061a771660a36a4956ab3e

SHA512
7ec6079682c861492722d920d0136fb1eebe9c07d0e950df6507c86367453092b2f87ddc20a73a9b547b3acd6f469aded8901301a25824783b7da4a79410948f

Download Submit