Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2025, 12:42

General

  • Target

    MoonXCrypter.exe

  • Size

    7.1MB

  • MD5

    8bd4830859e6d4ff593fd12689dd6c5f

  • SHA1

    b32174b222cdd84854838d5b31796d8e05fc430d

  • SHA256

    6bc29cb0c807de07a6d2b753691b03e13cb7b267ba4b24a3de567d65ab955207

  • SHA512

    4546f43380be8e82d21bca9310769a7b18a7c6eac4cb3f2b39435bdf6c418cacb58706bb6db7ba770af54bb4dec5ee99e105528d5c165fad1bb26838532716d2

  • SSDEEP

    98304:6jColtmW0fKeUzknPsi9rWlZroXKeWe54DzqGnl/Vxwt2camJ14lYWVDlx/BDyvq:6Plj0hUi9rWrQboqGnlNrS4lYqXJyi

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

sQz0RaHau8Jp14Tf

Attributes
  • Install_directory

    %AppData%

  • install_file

    msedge.exe

  • pastebin_url

    https://pastebin.com/raw/bQJb81hE

  • telegram

    https://api.telegram.org/bot7608996644:AAGLvUjQra1pbtl0EeonQB0HIhDkLvQXGHM/sendMessage?chat_id=7750016553

aes.plain
aes.plain
aes.plain

Signatures

  • Detect Xworm Payload 10 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 49 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
    "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Users\Admin\AppData\Local\Temp\msedge.exe
      "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2768
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Roaming\msedge.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1140
    • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome Update.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:668
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Chrome Update.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:876
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Chrome Update.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:868
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Chrome Update" /tr "C:\Users\Admin\AppData\Roaming\Chrome Update.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:236
    • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
      "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:2876
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2336
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2720
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3004
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\ProgramData\OneDrive.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2132
    • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
      "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Users\Admin\AppData\Local\Temp\msedge.exe
        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2736
      • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
        "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2500
      • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
        "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:484
        • C:\Users\Admin\AppData\Local\Temp\msedge.exe
          "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2872
        • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
          "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:692
        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
          "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2172
        • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
          "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Users\Admin\AppData\Local\Temp\msedge.exe
            "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2144
          • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
            "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1048
          • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
            "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1728
          • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
            "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2844
            • C:\Users\Admin\AppData\Local\Temp\msedge.exe
              "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1472
            • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
              "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2728
            • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
              "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2860
            • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
              "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2116
              • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2252
              • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1956
              • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:840
              • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                7⤵
                  PID:1344
                  • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                    "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1020
                  • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                    "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2640
                  • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                    "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2080
                  • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                    "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                    8⤵
                      PID:2176
                      • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1540
                      • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                        "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1980
                      • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                        9⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1420
                      • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                        "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                        9⤵
                          PID:2088
                          • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                            "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                            10⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1720
                          • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                            "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                            10⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:952
                          • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                            "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                            10⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2000
                          • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                            "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                            10⤵
                              PID:1684
                              • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                                "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:844
                              • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1584
                              • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                11⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2212
                              • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                                "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                                11⤵
                                  PID:816
                                  • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                                    "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2364
                                  • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2032
                                  • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                    "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                    12⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1508
                                  • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                                    "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                                    12⤵
                                      PID:2808
                                      • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                                        "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                                        13⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2712
                                      • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                        13⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2676
                                      • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                        13⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2920
                                      • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                                        "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                                        13⤵
                                          PID:2344
                                          • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                                            "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                                            14⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1384
                                          • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                            14⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2844
                                          • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                            "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                            14⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3056
                                          • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                                            "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                                            14⤵
                                              PID:2004
                                              • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                                                "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                                                15⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:988
                                              • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                                15⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1772
                                              • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                15⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1680
                                              • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                                                "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                                                15⤵
                                                  PID:2936
                                                  • C:\Users\Admin\AppData\Local\Temp\msedge.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\msedge.exe"
                                                    16⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2656
                                                  • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                                    16⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2100
                                                  • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
                                                    16⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1708
                                                  • C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\MoonXCrypter.exe"
                                                    16⤵
                                                      PID:3064
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {35EC545F-FABA-4174-B356-D10C67288AC6} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
                        1⤵
                          PID:1660
                          • C:\ProgramData\OneDrive.exe
                            C:\ProgramData\OneDrive.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1628
                          • C:\Users\Admin\AppData\Roaming\msedge.exe
                            C:\Users\Admin\AppData\Roaming\msedge.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2068
                          • C:\ProgramData\OneDrive.exe
                            C:\ProgramData\OneDrive.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:888
                          • C:\Users\Admin\AppData\Roaming\msedge.exe
                            C:\Users\Admin\AppData\Roaming\msedge.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1856

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe

                          Filesize

                          152KB

                          MD5

                          16cdd301591c6af35a03cd18caee2e59

                          SHA1

                          92c6575b57eac309c8664d4ac76d87f2906e8ef3

                          SHA256

                          11d55ac2f9070a70d12f760e9a6ee75136eca4bf711042acc25828ddda3582c8

                          SHA512

                          a44402e5e233cb983f7cfd9b81bc542a08d8092ffa4bd970fc25fe112355643506d5dfee0dd76f2e79b983df0fde67bfc50aabb477492a7596e38081e4083476

                        • C:\Users\Admin\AppData\Local\Temp\OneDrive.exe

                          Filesize

                          140KB

                          MD5

                          a1cd6f4a3a37ed83515aa4752f98eb1d

                          SHA1

                          7f787c8d72787d8d130b4788b006b799167d1802

                          SHA256

                          5cbcc0a0c1d74cd54ac999717b0ff0607fe6ed02cca0a3e0433dd94783cfec65

                          SHA512

                          9489287e0b4925345fee05fe2f6e6f12440af1425ef397145e32e6f80c7ae98b530e42002d92dc156643f9829bc8a3b969e855cecd2265b6616c4514eed00355

                        • C:\Users\Admin\AppData\Local\Temp\msedge.exe

                          Filesize

                          166KB

                          MD5

                          a06b97d6bd4489c5632d17e968a71103

                          SHA1

                          bc41fec2cb8c43f526c2c94449a1d7bcbcd364a9

                          SHA256

                          e1a9840703907437fc308be5a971e7b90d5dc1e24d03ff9988112ddb89b48cb6

                          SHA512

                          d0db4aee90306f589ca27afd1a988aefbd444f2c25418c8d54697db858d36bf627e3a68a890dcfda85a31a24a171d0152dc4473095ccebb483b4e18c5b107ddd

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MK6WK3HKDVP0KGAE8O83.temp

                          Filesize

                          7KB

                          MD5

                          b17c565cb5bbbb74eb2f1cf46394b4c1

                          SHA1

                          881cf50ff5deccc5fc24b460838d845e41647e91

                          SHA256

                          3f771b63ffd23f4b6f371a70a6dac5573245854bcb82074095663441389be959

                          SHA512

                          c1561b5b2a61e1e4ff5fa3179c8e4c7998311b527c6bf8ac87b2839371fc37986a73328e4421c000ce57db925225895fa5973fa52838c754a5cf761745906d53

                        • memory/668-74-0x000000001B790000-0x000000001BA72000-memory.dmp

                          Filesize

                          2.9MB

                        • memory/668-75-0x0000000001D90000-0x0000000001D98000-memory.dmp

                          Filesize

                          32KB

                        • memory/824-60-0x000000001B670000-0x000000001B952000-memory.dmp

                          Filesize

                          2.9MB

                        • memory/824-61-0x00000000022A0000-0x00000000022A8000-memory.dmp

                          Filesize

                          32KB

                        • memory/888-132-0x0000000000AC0000-0x0000000000AE8000-memory.dmp

                          Filesize

                          160KB

                        • memory/1628-128-0x00000000000B0000-0x00000000000D8000-memory.dmp

                          Filesize

                          160KB

                        • memory/1856-133-0x00000000010E0000-0x000000000110E000-memory.dmp

                          Filesize

                          184KB

                        • memory/2068-126-0x0000000001030000-0x000000000105E000-memory.dmp

                          Filesize

                          184KB

                        • memory/2768-20-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

                          Filesize

                          9.9MB

                        • memory/2768-10-0x0000000000140000-0x000000000016E000-memory.dmp

                          Filesize

                          184KB

                        • memory/2768-120-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

                          Filesize

                          9.9MB

                        • memory/2820-19-0x0000000000DD0000-0x0000000000DFC000-memory.dmp

                          Filesize

                          176KB

                        • memory/2876-18-0x0000000000920000-0x0000000000948000-memory.dmp

                          Filesize

                          160KB

                        • memory/2952-0-0x000007FEF66B3000-0x000007FEF66B4000-memory.dmp

                          Filesize

                          4KB

                        • memory/2952-1-0x00000000012C0000-0x00000000019DC000-memory.dmp

                          Filesize

                          7.1MB