fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786

Resubmissions

19-12-2024 08:32

241219-kfqvbsxmgl 10

19-12-2024 08:29

19-12-2024 08:22

19-12-2024 08:18

19-12-2024 08:10

19-12-2024 07:51

19-12-2024 07:46

Analysis

max time kernel
262s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-12-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b28242123ed2cf6000f0aa036844bd29.dll
Size

87KB
MD5

b28242123ed2cf6000f0aa036844bd29
SHA1

915f41a6c59ed743803ea0ddde08927ffd623586
SHA256

fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
SHA512

08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
SSDEEP

1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com
48	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2920	3864	WerFault.exe	78
220	4900	WerFault.exe	111
5108	4744	WerFault.exe	115
220	2408	WerFault.exe	120
4012	348	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1540	msedge.exe
1540	msedge.exe
3140	msedge.exe
3140	msedge.exe
2420	identity_helper.exe
2420	identity_helper.exe
2996	msedge.exe
2996	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3460	OpenWith.exe
2252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3864	2120	regsvr32.exe	78
PID 2120 wrote to memory of 3864	2120	regsvr32.exe	78
PID 2120 wrote to memory of 3864	2120	regsvr32.exe	78
PID 1676 wrote to memory of 4212	1676	msedge.exe	85
PID 1676 wrote to memory of 4212	1676	msedge.exe	85
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 2560	1676	msedge.exe	86
PID 1676 wrote to memory of 1540	1676	msedge.exe	87
PID 1676 wrote to memory of 1540	1676	msedge.exe	87
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88
PID 1676 wrote to memory of 1500	1676	msedge.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 460
    3⤵
    - Program crash
    PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3864 -ip 3864
1⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff87e523cb8,0x7ff87e523cc8,0x7ff87e523cd8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,18233767450843877165,3701432986524515343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2156

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 1456
  2⤵
  - Program crash
  PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 4900
1⤵
PID:2668

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1424
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4744 -ip 4744
1⤵
PID:4640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1428
  2⤵
  - Program crash
  PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2408 -ip 2408
1⤵
PID:1100

C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot\YouAreAnIdiot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1432
  2⤵
  - Program crash
  PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 348 -ip 348
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e7d552a-5751-4ca2-bd4b-01c1eb5a8dd7.tmp

Filesize
1KB

MD5
a36595c40616ee7c2ce96458ce2f6e79

SHA1
29e9d62d7b023bad6a6fef1df1bd3d7e877a5396

SHA256
2a4d2c8f60ea51a28d43a5ef346efc997d52e6a94a45fa3293159db9ea17e4b8

SHA512
a0e3da4b6d5026301464593d5c4c1892a5050bd1b5aae6aac124139f839582e314514ebe473982a62df5b583eb72ce14ea3c67a4fa705dde940389f6de3e1001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e12bf4e694d6193c4ddb227d3202cc08

SHA1
68c62fa59deccebb7a2bb01f8430c56b4313175a

SHA256
2ff9614e4810d4dd953ec3a778086eac14ff9ed94f835d70b37bc01cbfdbd286

SHA512
a82d1c83c417018c9fa48cb9d3ac8f4b1a32af319cbbf4627a3f7ce70c1bd83e7d6f447cc410ef51f1ba860255745130271d9ed82cfbb840fbaf59d85e563200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b83df41142d6e3d1164bbfdb589ffa50

SHA1
54953c967ef2e2f1b0ad32932a317a5584db75f0

SHA256
e6a228ff5458089dbe0f0aedd5dd2ee9d0a9b96c1f738d8ea6b98341d22ed2a6

SHA512
487957e5158fec3ad150ecbf9eb11a39019721a51d7cdf737071a0fbfa973cac001d2787ba3910a3f754b6be480d1aef15eacf5367853cfc337dfd0c3442856c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d852b14758251c9d6f08dad9a7253494

SHA1
4da823d167fa6b831a5f5932c63d807051f1708c

SHA256
3c36930b460742426135094630a45cbddec40ee15d4f5dfecba411125bbcfa1b

SHA512
80bca442ddb07ce267785cc87e9563515e71228b405baf674933efc2c284ae652f51f0a5a523af178bea226b427e592e431408f4fc7fac44dac82e897b08351d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
51cbf0991d6d71e485469a8757477bec

SHA1
51e284ebe6e4faa6f97c73baad678ce5687cfa2f

SHA256
9746c918a92a12eb48c8f68e160f2daaeb061abd5ccb8a50dcf7c738818fccd0

SHA512
9f00abaf5d9e4c5580ba714755f6b3b0efdd5f293b636e04148ee5b538763f7b24ee950c0910642f247be595d89086fbf3ce627cdc9f315d60b4870bfc9f9e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eeadb60afd1c66ad1e479262638b52b0

SHA1
804fb47b337da3ba9e52d78403d50c5d2e711579

SHA256
ba9dece4d48c1b36b65abff32bd068d50488e4ec0098f2b895051e291e3e5b2c

SHA512
b7be770e5d364506abfcf6d482326180d801aefbf248b5223935ccebc6bb6cd343976a6561564f172255b14fecd2f2bc08ea591ef07c3c02d23e864096512eeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1484eeff9bfd5bd5a291b1f08b0299a9

SHA1
4f03956eaae369c1127e03e614f7ce666af830d8

SHA256
3318d6534afe7fb47db4f4b433516dfe7fb7a893ddb7191a66b371077cb9bec2

SHA512
20d4f037ae6da08688666e622bc65dca9314c737027a43fa9a05bbe2f05b16e25195c392262307780afc44a86017a243b8358344183c6231a362dc3548c55fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c45ed66b8b9da0e949ee9de9d0b657c2

SHA1
6e9c1c18824df6399995bf5d1e1a24251dbdce0d

SHA256
0ca166e4c33f297b98ce886f6cfb322f8e24b570eff532bc7787f5bcc596af8c

SHA512
87a9d4da1b8025a46cdcd3e263b1450636619cf2ca96fb86ad62881b02c8510bdeb28a13856e54e7f5648ce14ffe434ee9c7bc64ae37947fd6988040daf90dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f504dc039ce03a067b1a0c88ccae717b

SHA1
f6a80dcbc4528b595e23c4700609a9229ae1a927

SHA256
15b8c8e0069939cc41e42cd2b8e645545237a36fbfcc79ba8b5c0d6d063434ee

SHA512
c7c0de3318ffc204e999f592ef10bcc5cbc0fcccc5283432ec254fc71a01b9193fcf3cd55258cd7893c09f8117e9c1d47b0439d8b5ba47bd78a3676705feb609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
39e6a0a8bc7434ecd7202f224b8f57d7

SHA1
e35f2da99f7109b9fbc396a675033159a19f495d

SHA256
4b77b473952d2575581547679ec0d4c9b36688493d0ea1dded13f2a490491f42

SHA512
9eed374b00d26d91bc2f1533b5d715109bdf5c8ec77011727c4274a7b31112a7031b07b2e59f6cfc99bda0ce84c6329159b5cd529d9545a93015b6f9790ac11a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b6f9505456a8729d2cfe77d199b5eba

SHA1
e532bc05c619f4d155c0af9d6c57325abd6dfde0

SHA256
bd64f1515d118aee601609a364c00434a2159e4661de626186388d0c6cdc7aec

SHA512
e03e685a5ea7b569b7a50b5dabbe7696988461dd8e5cdbd589b94744849919dd5ad4e6209e2d1cd4baa1f5a272d212705df37a181eb0f00f945fe0e4ded2c1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
16032c0ac9b4999fdcab36e2db7054f4

SHA1
2f3a73bc75e6ad1ba0573e2a55911ac1f1ad20e6

SHA256
da566562456fd44d7922a840a7025c0d95f83c9c70ded5b71ead96e0c14b4a14

SHA512
dded27ea342f655e208308dd983be468d1bf758cd68a57fbe49f4b0baeee22a99b44cf9deef4aab1ef86d4e3e642b6331572c801ad8a3edba2f229f6d3fa0a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3e2dedd2e66722b78c33fb7cc746d9d0

SHA1
cee8ea90fc82a32cf5fd283347674008253feda2

SHA256
63ab34935b8f94049f63b6ef330ab63b67717589cd536005090e83215b849cd9

SHA512
ccb10c8fe0ef3fafd2bc3316d37322048b4959b5e0e939b8bd589002bca6fe665b3d57f702d1f8ffa4798311d7a896603f310ef7bb42e3f549a08de8655c2e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d97.TMP

Filesize
1KB

MD5
e514c2117520c61f83781b60b49bca21

SHA1
6cda29b53e6118c0076bbf8d44d74543da84011a

SHA256
4a71db3f492b9d1fa4da743e1e9164c8cb24f677bb21bc64304d0542e7959734

SHA512
c7bd2e812c1bcc9c166d78985475b83f31425b2ee7943654687654887d72e607b4971996ffd3ea03edff2e00f7256a0640462881fef53d29135300cd8441da1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
adab09a9d6453e1fe83e5533186ceed1

SHA1
0613dc9ce4f9c1f34e75922bf1c447707646c156

SHA256
61776735e80ed4bcacd43bd2dbc6c02aa6691841eff885389a729739ae05abf4

SHA512
54977516990a6b736efafdd4394723c7ac534325e064d8b941470dd9b29e5b4b35d69ab6ddf666d42147b03cf461f313c0230ddf7079fc3b0192823c085ad089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55b3c595dc53f428774a8fc27b6114ed

SHA1
e2d55209fcf51984a2068c84b2f07040e6874934

SHA256
ce12ad11a9ddd6449031583133ceee636766e3fe34d5ecbb0969fbc9d50f004b

SHA512
6dd068b3da1cb35d1df860f56bab6d1a8d987e0254d2a696df5442dcdfbed4236c6d700fb1480399f629362d39922049901ffca67ff2a456940f5907cfbf3666

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a1eb644fb6d818b155bc97964e73585

SHA1
f5f99a7436b90cfe620eec85756ec0c0157c6ae4

SHA256
167659f9265d6c21b178b67e57f51bdaaa0eb7bfced04c264784b84a66faa424

SHA512
de97b5efa388c6ca2b3f6e37c9a6e735d329fe38431e67c61acbbad03809287f143b16fecd2ff6c06535a5042a18c7c561ed2140445d6f873f230be48f369378

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.zip

Filesize
223KB

MD5
a7a51358ab9cdf1773b76bc2e25812d9

SHA1
9f3befe37f5fbe58bbb9476a811869c5410ee919

SHA256
817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612

SHA512
3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.zip:Zone.Identifier

Filesize
237B

MD5
df98dc3b04142cb867ae6b5dcceb8594

SHA1
6a49638725a6921d6173227cc9cd5c7a7c91bb36

SHA256
0883c7fe0959ceb65ca1158355d1f5263c67a6e1bf857371c9c51a01523b3cb3

SHA512
5cf0d44ad372606a49e4e8d722a586d9de5efd4395adc902295fedaf9bfb47569d20335d7d0b0fe63415537d19916983bf3a1477bb0aafac1f18d73836f9619c

Download Submit
memory/3864-1-0x0000000000B00000-0x0000000000B43000-memory.dmp

Filesize
268KB

Download
memory/3864-0-0x0000000000B00000-0x0000000000B43000-memory.dmp

Filesize
268KB

Download
memory/4900-497-0x00000000055B0000-0x0000000005B56000-memory.dmp

Filesize
5.6MB

Download
memory/4900-499-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Filesize
40KB

Download
memory/4900-500-0x0000000005230000-0x0000000005286000-memory.dmp

Filesize
344KB

Download
memory/4900-501-0x0000000005120000-0x000000000512A000-memory.dmp

Filesize
40KB

Download
memory/4900-498-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/4900-496-0x0000000004F60000-0x0000000004FFC000-memory.dmp

Filesize
624KB

Download
memory/4900-495-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download