hxxps://drive[.]google[.]com/open?id=1RhhjkF8ykWeE7J9z08hmmZ5gx3oR2H8T

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/open?id=1RhhjkF8ykWeE7J9z08hmmZ5gx3oR2H8T

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	drive.google.com
13	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 5c022479d218db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{CD8A3060-6EF5-4F9A-8E6F-837859579D50}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A3392FCB-D70A-11EF-9361-CEB9D96D8528} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5560	vlc.exe
2864	vlc.exe
4360	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
752	msedge.exe
752	msedge.exe
1912	identity_helper.exe
1912	identity_helper.exe
680	msedge.exe
680	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5560	vlc.exe
5912	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
2864	vlc.exe
2864	vlc.exe
2864	vlc.exe
2864	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
5560	vlc.exe
2864	vlc.exe
2864	vlc.exe
2864	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe
4360	vlc.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
5248	OpenWith.exe
5248	OpenWith.exe
5248	OpenWith.exe
5248	OpenWith.exe
5248	OpenWith.exe
5248	OpenWith.exe
5248	OpenWith.exe
5560	vlc.exe
2864	vlc.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5912	OpenWith.exe
5992	iexplore.exe
5992	iexplore.exe
6136	IEXPLORE.EXE
6136	IEXPLORE.EXE
4360	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1976	752	msedge.exe	83
PID 752 wrote to memory of 1976	752	msedge.exe	83
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 3628	752	msedge.exe	84
PID 752 wrote to memory of 1648	752	msedge.exe	85
PID 752 wrote to memory of 1648	752	msedge.exe	85
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86
PID 752 wrote to memory of 4072	752	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/open?id=1RhhjkF8ykWeE7J9z08hmmZ5gx3oR2H8T
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe8646f8,0x7ffdfe864708,0x7ffdfe864718
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VER RECIBO DE PAGO IMPUESTO PREDIAL, ALCALDIA GACHANCIPA, SECRETARIA HACIENDA 899.999.419-1.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9353786972126472366,5154980192652970900,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5248
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VER RECIBO DE PAGO IMPUESTO PREDIAL, ALCALDIA GACHANCIPA, SECRETARIA HACIENDA 899.999.419-1.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5912
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\VER RECIBO DE PAGO IMPUESTO PREDIAL, ALCALDIA GACHANCIPA, SECRETARIA HACIENDA 899.999.419-1.rar
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5992
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5992 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:6136
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\VER RECIBO DE PAGO IMPUESTO PREDIAL, ALCALDIA GACHANCIPA, SECRETARIA HACIENDA 899.999.419-1.rar"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
5b5902d751b1fee437dc408060d0ad79

SHA1
c4fc0a6fa89043d1187d663116a4f448f157f91a

SHA256
9480bd1102778150ef4491fc736e182ee09b6676d857fb8a8c7e243e98852826

SHA512
50310f0ede369a33f1c804b7124b73883b3bdf752fbc47b422b804fb32ee18e9a3caed67b8b1d6912bdebf2f3e027f5c122c3e8d1e0f627543336e3d6ff50503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7b2cd9422c1f49681362fa357bd8cf7b

SHA1
bdbb686579f7c62e51e264607f0f6ecefff69825

SHA256
f629d715430335698d580797207213237cfb4bdc25604dbc07a29dac1601cb41

SHA512
8dfe1754e6ad22999712a3b5093d56e1f98c4392d66757d41cec0cc774df6f3d7f3ebadb0c6bb7d82eb3749bd72016c19914249bcb9783ce67072c4b408a69f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
317f62f19e221117f84ca8436c31c1e8

SHA1
f4eb6752a3ea89787c2ee7ef81f33b83fe126633

SHA256
5457498f6ac76352230159b6946643549138fc09df169731f3b1f4210d02d241

SHA512
e666a2d3a86c54db10c8646bdfc831b5dcf7df43ed72bfa9b54002bda75745088e7f2db3c3c4c818b35a722207e78b3681bf20901e75e8f739252f7788cd3d2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
00cb4ffdd539cca7ada2ddbb6a00bf32

SHA1
e46f2bcbbb79052e0e39ce677f23319401e5812f

SHA256
3f4844bf6968b55a568fefa1f791860cc404ac36677f67e69a7431d6dc6d6931

SHA512
2470e2921242ac2bce21399ed2b4574d4b873ff16252f933e32925a0c5b1ee9d07c901267ecad8a86aca6504166b078a55d4018f73ba25053e01a15908f7129f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35fc2bd8e4de62bf2d7243f58b01969c

SHA1
c57a37fed48d14eb245ffcd7e0a4baa458b885ca

SHA256
adc6b6a52b63edbd1646c383fbc3ae8e5a5168f03a7dcc01a8699fce7b347b6c

SHA512
5ff93b831ec869cb6824637b89c455911bfd1cbbc54c4c8798f69e5941ec84d2026b8199170328420e8304482eb7872492160e2394045e83edb6b15fc18a7336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
16db4df0588428517e95181f462cdb52

SHA1
49d4fbc4c4be4d03eac84a2384d9b9ec2b4b9b1c

SHA256
ce5c355b12f6d62ca56cedd5cfc4e799b983517c4527cb52b70933e1af716552

SHA512
11a661f607c593bbbf2cde824ce1a908a9cc3e3953bbe8b0733d69522a76d6cd7cc23a3ec80dcc57c3a56ab8390c9bff598641948c7416ce69f4c698900ce023

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d86b4465a1bdd58b54866404f027ad70

SHA1
d3c32e8a66177316104d992b6119e8759945ea10

SHA256
819cf8f30b65cce3f63124132fe57c3be2c1d73c9c891eb7f57c09b5aa0c23b8

SHA512
05728f6b98d674a6a5595197bec478e94a21c91ee3661ab8be54bd8032e4cbea9c418f86afd881224e9afd348a3444eddeebcab1440f6560ce5bd22201c4df3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe5701051e209639082c7f7365ab58b2

SHA1
5fd134e945bf5955dedb759dcfff0c54fbd02bcf

SHA256
cc9eb519e90d6fb930fbdbfbc40aea13d89a883fed48332966d1577ddf9e0778

SHA512
d05581da089ed1bad2db152d97d36c67b8b321a462221a90b236463808d13e4b8ff96329af7c4d473c4e6b02b900d56cd485d76c4a9603df102435fb811c9042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aeffd2f5f1fe4bddf9211a74d0027b31

SHA1
2d40ef28c3e3e47a3ae16696f21cda6b0a97eb91

SHA256
572de807d4d37ae6369d048671e66c452d7c94853892ee2640847dd873850fde

SHA512
aaf4258b3fe7b23757d3a1a554fde5349da1fb695262ffd989cc21412af8166bea8f99551daf121a360c5541de4fe4f2e9d1bf00cfd1c03dee6c8d24025957a1

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
637B

MD5
53eb9f073b7f76776a2193951a6e32a8

SHA1
4e08d890939c9a836240b0dc70af62f95b7fa15a

SHA256
4b5b218e8aae88c18849fbfcfb507e0aa292b006f29346bded6ec8ec428ff7d5

SHA512
58de8589a7c2e4d3895b1e9c9363ddd798a5e58d8e58214081e9c2ecf689e081ed7f6a88b58dfc0e157b028c2ea834a238025d5c1fcec2d20f5624325f358d99

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
182B

MD5
404fc97fa7710017c811420873e418cd

SHA1
0b788b567d653c5f7e4de751b0b51245eab2075a

SHA256
a301f7f4c2148cc1931f1a0a7a00ff35ea7ae87f0a6698b44818558d65ef8788

SHA512
d6f5cb74ee0f0e08b958f38b0ee26ec772986dcd02ad97320f1695c7900ab8339f5f47d45934fe32e4d5947dd377e51d122a3dd9f9efd8a14f4e3dcac78723cf

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
840B

MD5
73f5e04e2f5f58dde6bc441b7d0716a4

SHA1
6ae6ebbfe011d509968e5416eb87ecac659dc57a

SHA256
754a4af42921f7405229c6d2ea963a0226928393c60de078c3652b2b93660cd4

SHA512
7abaef8f111d9e3ada9fd9b6e8c4fac89d7f49af19cb6f9afc9ff65acd0477f13fd96db5e0a51f779a959380f5b932f4fe1d828d75eb99e36ec190dcc84a9b73

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
61f3eb271bf5f37a3dfe90f893e863c1

SHA1
dd186ff8e902dbfa4e29acea4a064170e4b1af92

SHA256
734594e3cda263acca9401de504823c2025ddc5aba7532390b5d42149923170c

SHA512
8bf9b1b499ec1be9a5d382515db0564a275dfc3a8b125dce4ab91e7a357c5de4b4dde397e99060bac30fbe5530839bce5b0357621fe7156e8c7a2f5e75a6f80a

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc

Filesize
94KB

MD5
7b37c4f352a44c8246bf685258f75045

SHA1
817dacb245334f10de0297e69c98b4c9470f083e

SHA256
ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

SHA512
1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 920411.crdownload

Filesize
1.1MB

MD5
ce29e0b556464112d0f74b00e2034b6f

SHA1
f84e7e5b9433eb71089cebe4898b16b30967d3c4

SHA256
1b4bc789c0ad70e008c7b8333cc2c9d2c3dc723057bb3c2674736c48630c5857

SHA512
b4fc1e7185a9ac048c42d0e73814670bd58fadfa1c822abe57bc0a4919d0dff5d1b2a0b4da540102d41d5c429b4457e4b09d3eb6972216f0118280c81d4a80b7

Download Submit
memory/2864-198-0x00007FFDEA100000-0x00007FFDEA20E000-memory.dmp

Filesize
1.1MB

Download
memory/2864-197-0x00007FFDEA840000-0x00007FFDEAAF6000-memory.dmp

Filesize
2.7MB

Download
memory/2864-196-0x00007FFDEBE20000-0x00007FFDEBE54000-memory.dmp

Filesize
208KB

Download
memory/2864-195-0x00007FF6FCDC0000-0x00007FF6FCEB8000-memory.dmp

Filesize
992KB

Download
memory/2864-199-0x0000022E42B70000-0x0000022E43C20000-memory.dmp

Filesize
16.7MB

Download
memory/4360-280-0x00007FFDE8FC0000-0x00007FFDE90CE000-memory.dmp

Filesize
1.1MB

Download
memory/4360-279-0x00007FFDE9740000-0x00007FFDE99F6000-memory.dmp

Filesize
2.7MB

Download
memory/4360-278-0x00007FFDEA390000-0x00007FFDEA3C4000-memory.dmp

Filesize
208KB

Download
memory/4360-277-0x00007FF6FCDC0000-0x00007FF6FCEB8000-memory.dmp

Filesize
992KB

Download
memory/5560-178-0x0000012376C80000-0x0000012377D30000-memory.dmp

Filesize
16.7MB

Download
memory/5560-177-0x00007FFDEB9B0000-0x00007FFDEBC66000-memory.dmp

Filesize
2.7MB

Download
memory/5560-176-0x00007FFDEBC70000-0x00007FFDEBCA4000-memory.dmp

Filesize
208KB

Download
memory/5560-175-0x00007FF6FCDC0000-0x00007FF6FCEB8000-memory.dmp

Filesize
992KB

Download