hxxps://drive[.]google[.]com/drive/folders/1ypIR9V2IgH0E4bxaoJe2w7YX8nUS1deM

Analysis

max time kernel
27s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1ypIR9V2IgH0E4bxaoJe2w7YX8nUS1deM

Score

6^/10

discovery execution

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
5	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4148	powershell.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3208	timeout.exe
2004	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
3092	msedge.exe
3092	msedge.exe
4644	identity_helper.exe
4644	identity_helper.exe
4080	msedge.exe
4080	msedge.exe
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3232	WMIC.exe
Token: SeSecurityPrivilege	3232	WMIC.exe
Token: SeTakeOwnershipPrivilege	3232	WMIC.exe
Token: SeLoadDriverPrivilege	3232	WMIC.exe
Token: SeSystemProfilePrivilege	3232	WMIC.exe
Token: SeSystemtimePrivilege	3232	WMIC.exe
Token: SeProfSingleProcessPrivilege	3232	WMIC.exe
Token: SeIncBasePriorityPrivilege	3232	WMIC.exe
Token: SeCreatePagefilePrivilege	3232	WMIC.exe
Token: SeBackupPrivilege	3232	WMIC.exe
Token: SeRestorePrivilege	3232	WMIC.exe
Token: SeShutdownPrivilege	3232	WMIC.exe
Token: SeDebugPrivilege	3232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3232	WMIC.exe
Token: SeRemoteShutdownPrivilege	3232	WMIC.exe
Token: SeUndockPrivilege	3232	WMIC.exe
Token: SeManageVolumePrivilege	3232	WMIC.exe
Token: 33	3232	WMIC.exe
Token: 34	3232	WMIC.exe
Token: 35	3232	WMIC.exe
Token: 36	3232	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3232	WMIC.exe
Token: SeSecurityPrivilege	3232	WMIC.exe
Token: SeTakeOwnershipPrivilege	3232	WMIC.exe
Token: SeLoadDriverPrivilege	3232	WMIC.exe
Token: SeSystemProfilePrivilege	3232	WMIC.exe
Token: SeSystemtimePrivilege	3232	WMIC.exe
Token: SeProfSingleProcessPrivilege	3232	WMIC.exe
Token: SeIncBasePriorityPrivilege	3232	WMIC.exe
Token: SeCreatePagefilePrivilege	3232	WMIC.exe
Token: SeBackupPrivilege	3232	WMIC.exe
Token: SeRestorePrivilege	3232	WMIC.exe
Token: SeShutdownPrivilege	3232	WMIC.exe
Token: SeDebugPrivilege	3232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3232	WMIC.exe
Token: SeRemoteShutdownPrivilege	3232	WMIC.exe
Token: SeUndockPrivilege	3232	WMIC.exe
Token: SeManageVolumePrivilege	3232	WMIC.exe
Token: 33	3232	WMIC.exe
Token: 34	3232	WMIC.exe
Token: 35	3232	WMIC.exe
Token: 36	3232	WMIC.exe
Token: SeDebugPrivilege	4148	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 3004	3092	msedge.exe	82
PID 3092 wrote to memory of 3004	3092	msedge.exe	82
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2448	3092	msedge.exe	84
PID 3092 wrote to memory of 2464	3092	msedge.exe	85
PID 3092 wrote to memory of 2464	3092	msedge.exe	85
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86
PID 3092 wrote to memory of 1768	3092	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1ypIR9V2IgH0E4bxaoJe2w7YX8nUS1deM
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed61946f8,0x7ffed6194708,0x7ffed6194718
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1980 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,10694255375278247365,16949621287635582552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_EXM Free Tweaking Utility V7.1.zip\EXM Free Tweaking Utility V7.1.cmd" "
1⤵
PID:3900
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
  2⤵
  PID:1056
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_UserAccount where name="Admin" get sid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3232
- - C:\Windows\system32\findstr.exe
    findstr "S-"
    3⤵
    PID:324
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4556
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3208
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2004
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3232
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:5164
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:5196
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56de2aae-21b2-48d7-8a5e-0814c5d43400.tmp

Filesize
6KB

MD5
2521603bba797da0dcbe90f7618b673b

SHA1
b32df88ff05e1b3f8f7d0c4be9d65a0dd588f5fd

SHA256
0b8e5942d781b344e69b95f2b0c07a15083a576ad28e0617a87ad74a250076b3

SHA512
486e38e8191b2c0deba6bd64860c4f4960e330a44456c072752468b4cc7060055c7299e0e3442bf3cf42b97c744318ad2b103fe17031683c1bbc108c047af4fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46f7252d320d1fbc38c16acd747e2912

SHA1
2fbb4fad9c1ae320b8cd25a2333d3a3e3e1f2ddc

SHA256
41b5ec8cc7d0fa383ecc1e8f3451426b2363b22adbbd06950b9d32878f088a2b

SHA512
6ed2c33b7e477f1ee1a8f1c484e9b573975113016ce9149ba1562aa3fcc94f074388d11a4c83030e874055a827001a30712d050318ff3ed44c740a1b3e12030b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94efd99143fb4c71eb921ac8cab8758d

SHA1
854ee8d23dad13d9cfd7bf51b1b6a10f8d4da18c

SHA256
6ac9a97074d2bbd4434e4c05e6b46418597b107529aaae037a76df37d912efe9

SHA512
b09fa8207ed43bf32a6bac174c6e94c4436f3e19d8924a7c6e1a25b3ed8474e97c34493bdd1844077cd1dee210de0442b14bacaaf8169fc40c41b8087314917d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
76caba18eba8cc316f259ac54df60ffe

SHA1
7ce3fddf4f471363c1bfe0a3488b81ff953e32de

SHA256
dc64eeea919ecaa6c1ac1bf414f2116556824a2138ca6802e4682a907ea5c022

SHA512
09501d17ada9b03f3046948441ac945028b9e08433b21d05a05aff1ab4ab6974217bc2d1da94c36f5bad817eeee675e74c9238677eee1c42f7f1a312525c6783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
916a7eabe4fe089473b2332154a1c189

SHA1
c455704e1560fa572142782aa4fbb1a1e677c446

SHA256
98056c074523a1a80873389c0cdcb64e0d0bb1c65e562efbba841011c1734a72

SHA512
00432d28a69338344b663dc8cebce2bbe83b0067c19a0387957612c3a25a70ad672287710e6db63323046a6365491a69fc542e0411825542e35db08d18e4f398

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2wfkdtzl.tne.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 610671.crdownload

Filesize
45KB

MD5
98cd3d6363cf97d5ba3bac68e578a02a

SHA1
07082270f40bdf9d6cbafdf219139bf1acc1c97a

SHA256
f4948a32fe575320cbd82574f8ab9dae1a3bedb2fc5c0418173927e61fb9f66f

SHA512
c2de27834b5c4a7e37b34852c792fab32bb4f2bcceb928b90a276e0d32c07780df4662b317f5bb93c973a91e6d9d720cf8ce85627ed6bb1653c5a725f6666879

Download Submit
memory/4148-173-0x00000190F6700000-0x00000190F6722000-memory.dmp

Filesize
136KB

Download