Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/12/2024, 09:54
Static task
static1
Behavioral task
behavioral1
Sample
PO#5_tower_Dec162022.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PO#5_tower_Dec162022.html
Resource
win10v2004-20241007-en
General
-
Target
PO#5_tower_Dec162022.html
-
Size
1.2MB
-
MD5
b2641a4ba8ebb6014d67d8e9a78acce7
-
SHA1
396b9b7b85e6c61917eed60d774f183bf071775e
-
SHA256
e2fdd71bb2b39a38ff9556cb57d0086f40224a76857540c98aaab76dd59021c2
-
SHA512
d80ca65a9e15d2ddc22aa25879e345e5061b906d481bccf6333dbb56e37200c034568cc0bf609a1676b73f3ff404ecaa44bf444606dc496ca9ae9634135d0ad2
-
SSDEEP
12288:sW7OJjd8FCSHkCJQwBgeeMXU3563tNw26HSg2BNjHyn5bAzJ1bErWdqDrVk7W/WS:+dDC6w0MEM3t2WnDylDuZ+kinyvLZc
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 61 IoCs
resource yara_rule behavioral2/memory/3144-95-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-105-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-113-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-130-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-161-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-160-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-159-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-158-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-157-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-156-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-153-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-151-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-150-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-148-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-147-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-146-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-144-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-141-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-139-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-138-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-137-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-136-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-135-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-133-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-129-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-111-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-125-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-155-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-154-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-122-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-152-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-149-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-145-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-120-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-119-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-140-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-107-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-118-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-116-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-134-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-115-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-114-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-132-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-128-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-112-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-127-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-126-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-110-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-124-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-123-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-109-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-121-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-108-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-117-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-106-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-104-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-99-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-103-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-102-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-100-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 behavioral2/memory/3144-101-0x0000000002C80000-0x0000000003C80000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
pid Process 3144 PO_0856580RY_MQ1094757_Reff_0957_Order.pif -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PO_0856580RY_MQ1094757_Reff_0957_Order.pif -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 288755.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1944 msedge.exe 1944 msedge.exe 2980 msedge.exe 2980 msedge.exe 1324 identity_helper.exe 1324 identity_helper.exe 1908 msedge.exe 1908 msedge.exe 6084 msedge.exe 6084 msedge.exe 6084 msedge.exe 6084 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe 2980 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2968 2980 msedge.exe 83 PID 2980 wrote to memory of 2968 2980 msedge.exe 83 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 3152 2980 msedge.exe 84 PID 2980 wrote to memory of 1944 2980 msedge.exe 85 PID 2980 wrote to memory of 1944 2980 msedge.exe 85 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86 PID 2980 wrote to memory of 1488 2980 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\PO#5_tower_Dec162022.html1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8f5846f8,0x7ffc8f584708,0x7ffc8f5847182⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:82⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:12⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3578843910925568904,14505422644123338518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6084
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4420
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2080
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3312
-
C:\Users\Admin\Downloads\PO_0856580RY_MQ1094757_Reff_0957_Order.pif"C:\Users\Admin\Downloads\PO_0856580RY_MQ1094757_Reff_0957_Order.pif"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
Filesize
180B
MD5669071f8d163078a83a7408d5eb24185
SHA1bc5be1f5eab772dd1aa36bac9cda3c0fba25514a
SHA256240f5439fe2917de112576d1479058cf2ff96ab0be0c95ebd3210ae84ef1e8df
SHA51223fc5e51efa4b8c2d11b6157562f6773e092cfe9e95a555f0b029acf1063604ab9ff4f22a07b5887d6e5b3bcfcf77a1405244c0ca04350a47e1cb3608f6e1eb0
-
Filesize
5KB
MD5a54447d3e65bf469ef08f747c6ddacf0
SHA122a45f033f68e25c4a19b86fed0989d0ee18caf4
SHA2563ff21d71d59e670ecdc9718fd88f39e4c08947fcf8840ede7a103965d0a5fb6c
SHA5123a19a12c0a8f87b979ce57b7e32c635c6c62b45bb88738b53d050ad46de0dd8333bc424946be80a00d5a3281ac0a3d5b262cbaf4b546ceca07e6b76ef777f948
-
Filesize
6KB
MD5d9d312f5a46e73b9f29e4ecf061cbc38
SHA11c48cda6e303a8cdec39c8b7cef60d877538a04d
SHA2565484a114cf78875fc98526d4934237ac79d09a06828b762763aa9c25f17e40e1
SHA5121c589d85b297af203828878bed0aa99ca18d07795fb1fa97285076182c4dab6e5c7a5c091d92c5c3b844ddcefca8b582e03c1f5d060f5d699375fd9715e3014b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5b873cefa6a02d8711fa076272011b5dc
SHA11b3fac218113a618cb7d97592d0308e7fda96389
SHA256b2edecf3baa615ae6a8a572b03043545936ab0234c7027bb4c6452368a6b9127
SHA512c4f7de7fffe62754e5cbef74bb6596767a7c1ec0f4bf25bd06712a9bf9831a945f7c5d11c841fc9b4b69f24e5768ce4ff6ebbd6b31d5d4a27d82d76826238caa
-
Filesize
10KB
MD5d08d69f9420e55c197ccbb8e211c7b55
SHA1117907973834683151997e5ab4f1651fd8e63690
SHA256be4a91851ed4f6eed06c2c65d30f2efb3407435393ba117eb7afba0b2cf1653d
SHA512b1b071c70d1729bea2aa90f6975f58d148466d14d428770c9b0cbaabcd07b668444f63ca37dc2fb990fef63e2c687ae43e0d93b4c852c0a50bcb00990d01216c
-
Filesize
932KB
MD5ab75907a33d670348e8fbf8fe85a10b8
SHA138e16c806df3cb34c6ba31a2ee9e14a9ba317ea4
SHA256e5d1f14db3695ee7fa122585054c6544a82db540f29b23ce77c4aaa86db85f4c
SHA5120d602cb989cd16ef3d55821dee0c40c30997c1cb33818e5de4afb2327f85a0f904229107225b5396203dde92bd4f1feb805ac4e42edaceaeb121038184e5166e