hxxps://drive[.]google[.]com/drive/folders/1BfuO-Le-xlDPY_nfoWa4Aw1kzf6n4xlA

Analysis

max time kernel
149s
max time network
144s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10-12-2024 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1BfuO-Le-xlDPY_nfoWa4Aw1kzf6n4xlA

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	drive.google.com
9	drive.google.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\dda914c1-b67c-4f96-9d1d-abe5c6693dc0.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241210113332.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
3956	msedge.exe
3956	msedge.exe
700	identity_helper.exe
700	identity_helper.exe
4200	msedge.exe
4200	msedge.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5300	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5300	taskmgr.exe
Token: SeSystemProfilePrivilege	5300	taskmgr.exe
Token: SeCreateGlobalPrivilege	5300	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe
5300	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
6100	OpenWith.exe
6100	OpenWith.exe
6100	OpenWith.exe
6100	OpenWith.exe
6100	OpenWith.exe
6100	OpenWith.exe
6100	OpenWith.exe
6100	OpenWith.exe
6100	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 1680	3956	msedge.exe	81
PID 3956 wrote to memory of 1680	3956	msedge.exe	81
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 1264	3956	msedge.exe	82
PID 3956 wrote to memory of 936	3956	msedge.exe	83
PID 3956 wrote to memory of 936	3956	msedge.exe	83
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84
PID 3956 wrote to memory of 1048	3956	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1BfuO-Le-xlDPY_nfoWa4Aw1kzf6n4xlA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe300246f8,0x7ffe30024708,0x7ffe30024718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff735705460,0x7ff735705470,0x7ff735705480
    3⤵
    PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12679004671533397166,12633785357982962826,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=252 /prefetch:2
  2⤵
  PID:5372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6100

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef84d117d16b3d679146d02ac6e0136b

SHA1
3f6cc16ca6706b43779e84d24da752207030ccb4

SHA256
5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000

SHA512
9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39191fa5187428284a12dd49cca7e9b9

SHA1
36942ceec06927950e7d19d65dcc6fe31f0834f5

SHA256
60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671

SHA512
a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10bdc544-251b-4f99-b9ea-24d637c7f0a1.tmp

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
25KB

MD5
ab77c85aab42e61d0557bfe285bcafc0

SHA1
ac4241859bef658513fee5ae997b08543b8029e8

SHA256
32a74d447d992c99982a6c6979935c3eeffc358bcbcf7b1843ccb8021523f398

SHA512
41aaeb6c514f1ec1e97e213739ee2f4cd731cfa17fc1bd2c0c2d6197eaa487ed4b57c8d359ddaabc8764db4e12d3000eb2e23f884aa5dad0962ee9e0ae1d02b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e27029f524427d437bf1ffaddce541f5

SHA1
17a12947a1e881df000706bbe101b0c9d09bd685

SHA256
15867d130dea909679e0666c47f0f15bc16951037ec6b85736b8f7f4cf6794d2

SHA512
4ee63e438764598a6eb20f58b502cb11165193ed407010cadc18f5604235fcdd070f9c8c2fe79c4f153e933faeafc24a2f1bd4c889a15bd640a2a802995c9a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
df6fb895a5944f7fbc27bd5e11aea55d

SHA1
5bbd060fd73925d5192f7d28d104ac8f881c9495

SHA256
d058df5e939ad4f7f6ed0915879d71e13eb5c0533eb2f23461d8375d5a4deb55

SHA512
c6e22137aa8ec85f9be91b1cf1c62d70d61c343fc61e8e22d85744a86f05886d7363e83961fe1b439f2f40c67b4cdc7e10f8aa335e68178cfe1f023be0341d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
c034604c39d0764311dc18892c4ffc38

SHA1
22d0ddeea991a259087d453689885be8fe5e5067

SHA256
744f9cb5f164d8036d351383839d2bae32863dbc4cf561b345800a52337d9227

SHA512
58e0cd047dfd8ad056a6307237f8a5a219894afb89a19a9e164c730eb2bc33ff8793e765d22a0fd1f0570bc4dd586f3699a2fc60eb955708aa8c0031de5a900e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
fae1448bb30554d8ea122a39155e4d24

SHA1
0ae934ebd6e5bbeabc4e156fda8e59065e424f80

SHA256
821a5fd792b2e620c888b192cd44e2cae5d7aeae19ada60f89539d01bfabbeeb

SHA512
870a7c44986735e5c52904c4ff39cfd1a44eba17c62aec1832fabfcae18acde5f2b33c56f5936674096679e6ba8edd4815c61bec225f8ea5fc4c41dd05c3099e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58fc0e.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1677825da6a3c7a15d79bd3d0d134f04

SHA1
8eeec345b7dffaa02a57ff91f3728358cb8221d1

SHA256
c96df8d1d9de04be0015e97e768b15eff66069e9a6826dc6e497e767f38cb692

SHA512
2d3fc0583f1b27c26acd18b56f076045f7f2636e5af0dbece1a6b2b0bd06713294c9316add1ef048ef93706bb656c4cff76f3038dcfca2dfe5d88459f4cc3988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5bff0cda023440e06b1a2bf220a1f08

SHA1
f7e2b4245e6ac97b6ea98f78437e4c9413cdafb3

SHA256
272a3f6130d544a3713575d4d0c726f30e4aae86adfd992978ff0169e1d1125c

SHA512
762fd1d06a0539bc330f62cdfc3bd7755ee460fc55826e3aa576e1ea5253842144de9d1f2d3319c6b45a7b0ce5e258a533a8f319eb11cc93957899e572cbfef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26a390b979c9a978bd1a2fd860fddedf

SHA1
1ce478566270990e99425eeed3d4bc6ba22f7f9f

SHA256
e19fa4125363601a01f1402e0afcfa5f6201f8081c9bad4040536c285e799061

SHA512
c936ad416c7481bb2758e67d590fecb4a3c47117666900610a56cc3cbfc92478bfab9f2458a2b45d850b041b3353cd3527834ffc76009f26f78e88423a5a2cea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c623000504ca08ccf7a1f3e6e66aa3d

SHA1
23e320da4822db5fb7aacb807d2a070add69c05e

SHA256
3d5af9aac762ae6ba226b1f1e8a06271ff1e87ceb2e48ddb9e279ca2a7852bc5

SHA512
0de6811a2012fcd0cd1f30f79c4254979c19d68300808f2476d328c08fb18bf4fdfe1c9f9ec2f78902811255272457c500d57cc847828a04434dd884d967edd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e98d1679e15688ad133f11eee8458ee

SHA1
a4b1a83f0a3f2867954d3146d95d314441950606

SHA256
8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e

SHA512
eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60d82bd601d64fd00bb0373f5ecd65b8

SHA1
0e8bde426270dfa3ea285c2c5b7282ab37771d4c

SHA256
bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97

SHA512
5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d4931ef371308174b1e1e12f124fb379

SHA1
691c1d9747d983d185b55f068dbb2104d3b34fda

SHA256
2bcf442cd93b70a2c96ff06234f6c5df63fedc70c74de84c3b5828297d3a2744

SHA512
927d944ce8b4e85dff4c09fc00db62b5dec8cc9c37ce7b5a58cebb22b3bc1158784d6b77ecf7dd250aedd53fdb7dd6c33be6ea2f23664d20200176fe4816add7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2efe119330f8f01afbf9c91ba34c1a65

SHA1
2aa4bd23501e2e9e9aa256d49b605e0b1f5365ff

SHA256
7714aed3bdb807df65d630f35c96254c5cd614b838623c9072c2176b66fd5809

SHA512
b7785a6f3818396dfdd259941831e11dd91d1ac23c0a861ad9c144655124f3960df5bb9fd5ed3a57e2ef657566542d6b4ef5d70292a138a81bf41b29e5c42bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71d0227f28a13faec9a60d2e3b91f74e

SHA1
937fc87395baf7a068e11721edf1879945c59c2f

SHA256
dc51bd390645085e4482110329d4dcfa3c02b799e5a26efed591984bf2548ec3

SHA512
7fe63d869d5e1d98b444e8e293e0d1f5594b1b888bb623605430b0a091301e2b5d8f69127a51ec1bfbe5855c9822212d3a68ad5fac74a192bd9a5631776958a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
71e5d8e9f91adcc221ef4573f6c12f7d

SHA1
19c1fd07e530074025c25e6ca414063d71a7888f

SHA256
a6994e77612a680b1a71982909e2980077b221b2cd2de6db8dabbe4be5cb6d18

SHA512
07572b8e7e4bbe1be349d37f4a1f56c22f6bdcc4f3da0631157fe8a8c4c63a2c1a0c9e9261015413732f427027ddf49a6588822810fd24f9234fefaea9030546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584764.TMP

Filesize
1KB

MD5
912064106a1920d1b6562c67feda71c6

SHA1
93e686c9246e774b6a73da0deb83e7221d666db0

SHA256
0ffb9f1b422fc88fef8e5953e76a305011f57ac0b7e9a89015b745364140a595

SHA512
7c335c59099167b8242eb2b2121ab044258a571db128875a01953c831e8efb49a340dacc7481c3594714a49303e7d04c3e0c91524c3dd84e13e2c6fc17a62239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4663e6794fccc24dda253a33e3b05496

SHA1
3fd9f75383f9687cc749b266daa9bb0b2c5ea9a1

SHA256
697cf61bd0b2f967f58bb0462094ce11720cc1e425a9cb642670300c454923b4

SHA512
e93f628543c6f1af90e87155c347a66bcad9f6552602ef52a268d06936e767cd43e93091ab204edbfb4c0a261a110ea901821a156b0314849639e658743049ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
454d9ebd1ba9665219988809ff873ff1

SHA1
2e80222ed7762a3d65ce45129240cef30b57d3a1

SHA256
82477e5d17b551ef515f45697fe6025f1c56483ecc0b357a4e0c79bfeea87dd1

SHA512
096b14284d7c12736a0bc52f4df5640a2020f935f3536863747218c38afbf1b9b0490deb951c3f26ff2cf2a57f49e5276186ec887cc2bb5ced579f5655e75fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8074ef34b6668542ba2675d1bd1246c5

SHA1
ac5e89687c083263c1d2c757ba93fc5cd3d3514a

SHA256
5eb294201c8d3232fd4220c55c1bc02ae4f138e94d1c2591c8abb38e357d8c76

SHA512
7b64a1b340150de72a6118f4d99fa0bea97c660af4943d4fff7e59c86a75c61222dc55604408b2a21d1d8681771136fbc7db78155b4ed43177cb211b5536b4d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f248a6209bd981a058f37dc531981743

SHA1
9f4da3d18152bfd6507eeda7fe5183db3d15ef44

SHA256
6a59a1e4a1f4c3bca874606017d26d93d772d066e1d18a1449a8070f06fda4b9

SHA512
385364e3508bfe389ec9fe70446eed202aa72cfa20147356009178d160bd8dd591ab8f7eb5afc8650d23b15bb572369111658185351b9324d037032940a931b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e8de1efcd883d1cc069641002f707ae5

SHA1
b5d937cf4e2e30ca6927bce61771ae8c021bdf7a

SHA256
2d29dadce7801b0e66b1b2457304cd28e78705b80d4bfdbf6a20760b91c8fb63

SHA512
4ebb816aaf727de64bcbf00f4c6e081eb0cf0afd338d4547f7176b759781d9527753462588ebd981491584663752478a1c8fc8af945469f4c23d7b9a18a23918

Download Submit
memory/5300-455-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-456-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-466-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-465-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-464-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-463-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-462-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-461-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-460-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download
memory/5300-454-0x000001BAA1290000-0x000001BAA1291000-memory.dmp

Filesize
4KB

Download