Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250207-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
08/02/2025, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
random.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
random.exe
Resource
win10ltsc2021-20250207-en
General
-
Target
random.exe
-
Size
1.8MB
-
MD5
ebb19356f4a1f8d9aa63efcad72818a6
-
SHA1
005666bf6270b976c4e2c2faf13491da29389c7e
-
SHA256
8313c081a92b8c3e8debe8b6662ce1531cbf3d0e6464c1a6d0ee178568a52c40
-
SHA512
f4821767f3056ad7c2a58de117667b28a1a2e619d495cf3238a7f36aedc8bb0b4add7affd0cc0ae9020991f28c6f67b4dee1d937920eff99e9789ea1b0a95ec8
-
SSDEEP
49152:VfVcxMJmPwpUkpePPp9gkCuHswI68sgJ:VfIPkKItyr8sgJ
Malware Config
Extracted
stealc
reno
http://185.215.113.115
-
url_path
/c4becf79229cb002.php
Signatures
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1N2OG450415RVXY61W12XJTB36NWTN.exe -
Downloads MZ/PE file 3 IoCs
flow pid Process 33 3628 Process not Found 37 1512 random.exe 90 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe -
Uses browser remote debugging 2 TTPs 9 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 3632 msedge.exe 1592 msedge.exe 4996 msedge.exe 3232 msedge.exe 4724 msedge.exe 1508 chrome.exe 3472 chrome.exe 4904 chrome.exe 3708 chrome.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1N2OG450415RVXY61W12XJTB36NWTN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1N2OG450415RVXY61W12XJTB36NWTN.exe -
Executes dropped EXE 1 IoCs
pid Process 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1724898312-1363836731-1320094270-1000\Software\Wine random.exe Key opened \REGISTRY\USER\S-1-5-21-1724898312-1363836731-1320094270-1000\Software\Wine 1N2OG450415RVXY61W12XJTB36NWTN.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1512 random.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1N2OG450415RVXY61W12XJTB36NWTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language random.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 924 MicrosoftEdgeUpdate.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1N2OG450415RVXY61W12XJTB36NWTN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1N2OG450415RVXY61W12XJTB36NWTN.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133835154642531831" chrome.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1512 random.exe 1512 random.exe 1512 random.exe 1512 random.exe 1512 random.exe 1512 random.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 1508 chrome.exe 1508 chrome.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4788 msedge.exe 4704 msedge.exe 4704 msedge.exe 3232 msedge.exe 3232 msedge.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe 3232 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1512 wrote to memory of 2924 1512 random.exe 89 PID 1512 wrote to memory of 2924 1512 random.exe 89 PID 1512 wrote to memory of 2924 1512 random.exe 89 PID 2924 wrote to memory of 1508 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 90 PID 2924 wrote to memory of 1508 2924 1N2OG450415RVXY61W12XJTB36NWTN.exe 90 PID 1508 wrote to memory of 3196 1508 chrome.exe 91 PID 1508 wrote to memory of 3196 1508 chrome.exe 91 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 3352 1508 chrome.exe 92 PID 1508 wrote to memory of 4476 1508 chrome.exe 93 PID 1508 wrote to memory of 4476 1508 chrome.exe 93 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94 PID 1508 wrote to memory of 4560 1508 chrome.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1N2OG450415RVXY61W12XJTB36NWTN.exe"C:\Users\Admin\AppData\Local\Temp\1N2OG450415RVXY61W12XJTB36NWTN.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""3⤵
- Uses browser remote debugging
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc6f50cc40,0x7ffc6f50cc4c,0x7ffc6f50cc584⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2316,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=2312 /prefetch:24⤵PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1924,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=2356 /prefetch:34⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1956,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=2480 /prefetch:84⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=3216 /prefetch:14⤵
- Uses browser remote debugging
PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=3256 /prefetch:14⤵
- Uses browser remote debugging
PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4596,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=4572 /prefetch:14⤵
- Uses browser remote debugging
PID:3708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=4740 /prefetch:84⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4672,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=4832 /prefetch:84⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=4896 /prefetch:84⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4984,i,5758685782654112107,3043659230519030423,262144 --variations-seed-version=20250206-180041.353000 --mojo-platform-channel-handle=5000 /prefetch:84⤵PID:408
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:3232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffc77ba46f8,0x7ffc77ba4708,0x7ffc77ba47184⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4505920224904666497,13180274739504605555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:24⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4505920224904666497,13180274739504605555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4505920224904666497,13180274739504605555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:84⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2104,4505920224904666497,13180274739504605555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:14⤵
- Uses browser remote debugging
PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2104,4505920224904666497,13180274739504605555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:14⤵
- Uses browser remote debugging
PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2104,4505920224904666497,13180274739504605555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:14⤵
- Uses browser remote debugging
PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2104,4505920224904666497,13180274739504605555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:14⤵
- Uses browser remote debugging
PID:4996
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzE0MUFBNjEtRTBDNC00NkQ3LThGMDMtODZDRUMzNEY4NThEfSIgdXNlcmlkPSJ7NDg3NDA4QzctNUI4RS00NjcyLUIzOUMtNDYxQUZDMkMzODNBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NUJGRUZEOEMtNkVCQy00MDA5LThEODItNUYyNkU3OTZDNjExfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NDE3IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDc5NTg5MzQwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIzMDE1MzM5NyIvPjwvYXBwPjwvcmVxdWVzdD41⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:924
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4500
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
152B
MD52bc61c9dd37a26f03ccfdafcdde4c34c
SHA1de6fcb1f9bbe50fc948ca011f1e976ccd760b6fd
SHA25685bd40ee06663e203c447aeb642386190391d25cd763501709b36197cc40d328
SHA512047fb35111f99fcde0590a0481bdbafdd134b5c14c29a5fdffa398138057523ef42caeb17ccbcecd0829dd1a6fe6422d34972caebffa40715725f9cc7556aed4
-
Filesize
5KB
MD5a8bcf796189ee029718041f8cfd38856
SHA142319f0a11438e0f8ebf0048851613b2af9c4eb1
SHA256ebedfa1f7dc16ae0887b2e094dc0290a8e52b5c652cdb97d2725105c195cf346
SHA51296942ddc7a3fe61eb7d3f28f3a4017b309bc9ed98366a92f859410edcda437e9bfec7320e57ff052b6b35510bd213889f9c396d95a83d71989e11b283c9da1c1
-
Filesize
112KB
MD5e03fc0ff83fdfa203efc0eb3d2b8ed35
SHA1c705b1aa42d84b3414fdc5058e0fa0a3dc9e1664
SHA25608d550d1866b479c6c41ebbda7b453dba198ee8744a52c530ff34458024ee1fe
SHA512c0840930d7a9cf16e8fbefefd09c564eabfcfb6e9df1f9b906b830e8218a818c3f9721f9ce1fc2a96b2e6ce725baba0dcd5810a9b55d20b3c9d6f4569b9008a2
-
Filesize
1.7MB
MD59029a85b5ffa5bd915cd2a463bcda9a4
SHA1adab3a0f4d43b646e6361553f13d35e434a12cf2
SHA25668eeb68d21179446664122d2c8cc1ff9266a8643d4721a40a83c029f1d70c8e6
SHA512c98cc795d29a937b16eee3620373bf3fb54c32fb36db510df813f3760816785b696fb08c88cd4e8ffb457872fbede9b01b2c2d7944f993d2607407bb637e0fe9