Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/03/2025, 00:07
250323-aejphstxdx 823/03/2025, 00:06
250323-adrzhaxqz8 823/03/2025, 00:05
250323-adkkestxbw 323/03/2025, 00:02
250323-abxrzaxqw9 1020/03/2025, 23:27
250320-3fd5mstrw6 1001/03/2025, 19:51
250301-ykw4sszqy9 801/03/2025, 19:50
250301-yj8ffazqx8 801/03/2025, 19:47
250301-yh1dfazxev 801/03/2025, 19:45
250301-yghr1azp15 1026/02/2025, 02:07
250226-ckdrka1m15 10Analysis
-
max time kernel
46s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2025, 00:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Da2dalus/The-MALWARE-Repo
Resource
win10v2004-20250314-en
General
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 128 4464 msedge.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mistdrv.sys MistInstaller.exe -
Executes dropped EXE 1 IoCs
pid Process 4516 MistInstaller.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 126 raw.githubusercontent.com 127 raw.githubusercontent.com 128 raw.githubusercontent.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MistInstaller.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871620651821174" msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-805952410-2104024357-1716932545-1000\{0E79F282-F02B-4535-A1C1-624324DD0C8C} msedge.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 668 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 4392 2476 msedge.exe 85 PID 2476 wrote to memory of 4392 2476 msedge.exe 85 PID 2476 wrote to memory of 4464 2476 msedge.exe 86 PID 2476 wrote to memory of 4464 2476 msedge.exe 86 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 936 2476 msedge.exe 87 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88 PID 2476 wrote to memory of 1904 2476 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2bc,0x7ff97db3f208,0x7ff97db3f214,0x7ff97db3f2202⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Downloads MZ/PE file
PID:4464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2244,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2624,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3496,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:12⤵PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4284,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:12⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4228,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:22⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5256,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:82⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5588,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:82⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3484,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:82⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5328,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5328,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6232,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:82⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6380,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:82⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3660,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:82⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4380,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:82⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5064,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:82⤵PID:5144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6604,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:82⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6588,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:82⤵PID:5304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7148,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:82⤵PID:5608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7192,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:82⤵PID:5284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7288,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:12⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6960,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:82⤵PID:5300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:82⤵PID:5344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7200,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:82⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7404,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:82⤵PID:5660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4296,i,4766545695201487621,8710147390202548869,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:82⤵PID:5144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:3248
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5836
-
C:\Users\Admin\Downloads\MistInstaller.exe"C:\Users\Admin\Downloads\MistInstaller.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD50db1d88802048ff847bfcf47035335bd
SHA1bb54059e5b145da464f6521ae67353889ce00771
SHA256416525d2bfeaeab0950175c0eab55ad35e84518ef5299f10565023800788cf9a
SHA51232c5b42febdb38c3a30eb5179b8aa20a5e731b0e83aab16ec73d27b4108bfc89eb6316f71a988388cb5df19267ba823f6d0220fab5584667ba0adb0da1152a30
-
Filesize
280B
MD58734b4a181214bb62f91cfa36c7e2c98
SHA19cff323f10778a23d73ac3dcffc038d3bf661b78
SHA256e06afe980fa56c8dad3e7c6b8d0d8f1e7eb9a4860ac715e966026fb7631c3ba5
SHA512e8648a54da9aa24b6cba1f0377a0ce33979ea097554bb6347f252cad894ad4134e1fe839abc80eb48e2510061d5c6937e80374d32f95afd4cc8567b57694ac36
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD59a3a8e02f39ad081ba31915e8d77c816
SHA12961dd96cf370e346b047bf75b425906fa7101e1
SHA256eaef9ae37c6b564663c16c99edf4dacd1761c4fe8a0f6989eae0a1351624c140
SHA512aa9632fd8048069b8aa0ef2358a7f3063d141ed3794fd96b67ea58f9d5c71894682434a4d78143d4b6e4aa0a4344a80f7b5ac7bf0e6387499d76c28d75fe431b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5864c0.TMP
Filesize3KB
MD5218ef660fdfb636c64dcf28140cdace3
SHA13f92a13e266b623fc1eacdc0ffdc426df7671165
SHA2569ad9e89917e50325a9339743bf75589988800b0020593b0bb3217a6e32b6657c
SHA512140f11a94b8aae282da1923a485e0de28f203a74e678e0107e351640ab677f15025d9fab26568c3ccfbace703b97dec005c5d7146467facabfccb6d1ef852a83
-
Filesize
69KB
MD5164a788f50529fc93a6077e50675c617
SHA1c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA256b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
SHA512ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Filesize9KB
MD53d20584f7f6c8eac79e17cca4207fb79
SHA13c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA2560d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
SHA512315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
14KB
MD580504d6ea3cf71b09c61b90172d9cabd
SHA1a36927af65d25f14e1a40dd027b644f30a011347
SHA256dced60d93ccaa969c54efa11d2a498e20d68866176236088dee40cb7d7f5e44d
SHA5124dd0195408ebf0f93faf762bedfa017bc7723699109073d1ffa17016145889cb85263484362aa94cc0e377dc18531e1c7968d67f284b14f147ddf6f625f95ed3
-
Filesize
15KB
MD5f82918233c1b7b76940b37325d57b940
SHA167e0f13577514a451954c7ce9501e6df6d3f08fa
SHA25679f748d8289a9c31387cbf228daabd40f595b649367803b5920e1b524d416394
SHA51254d4d2626d300216ac33b3f443bb89011d3ffb4a61a33cbef2ed7d4d00dc26ffbdf176564fc4704ae250151a98fac712f3ed345a5ba1aa928d563cd92ff04e82
-
Filesize
36KB
MD550f217811d5c69d71db20d5c32a7f98c
SHA1af5211ba4cff1c9fd45ab6a6c016063f5dfb5648
SHA256e641b72813bb5cae769648baec1c76ac3f4526c4942c55793107eefc4d9dd7f5
SHA512e5c4cf8e51098bf0ce0cc15371d1e8188a30c4e4e4e1055d1486a497f8d222dfe0da222fc4286aaa768925d20cd24f26d12e9aed1e444b2fce1e9b9da3e7f0dd
-
Filesize
4KB
MD590cf05866477d2f21aeabbd7ed21495b
SHA199beb02308a133030e2b022035b913f87a26164a
SHA256a55c874ebb8bb4966226ef767293fbefd646a582f04ac853f662ba8a4b7b4133
SHA512374bc83fc817b79dbc41939683a200cc27c9f87abba3654ca76baea58977fe9161d6289fa8212f7fd60ff0cacb96efb72b008101f1dc626d30a8a9a60a1e5304
-
Filesize
7KB
MD5f7d2605fa5274b3d3e8b6c0dc6e27a1e
SHA19df6212a9298915ba6fa947441bc484e6f9e07b5
SHA256e6b9a6550607fb9fc137371a55e9ddf29ec3f113f2d1667ae068829f4038b1fb
SHA5125eff31ecffb1ea786a88b2798954f6a3cb09c76612906b1a55b995eb878241fb5ef48bc25e98737ccd3740a1fb3fafa9ba11f4835eb8a8e31671e67c209bea56
-
Filesize
6KB
MD580ee2acaa2015220bec0063f26495c8d
SHA10042ba1a61a5d369439c95ab3b4eaea5092b0721
SHA256f99972acab3300721894450a8cb11a6ed32f3d174cafc2926ff52838a4d5db7d
SHA512396845e78fa72d9fb00d74f37092992c2ca646b210410ad532049301a98c189f593e14588278739e38a84cbdf885e75c98ce0d65cf2bcb59c0013503de0d5323
-
Filesize
30KB
MD5a539e9b71339db8979b9bdae05c2b311
SHA150a831dd2d0487fe31ed516cbf6768e595644dbc
SHA25661cfd95b073d6e430e5221967859e797159b9fdc0301d5240f4b1f880f8514ac
SHA51205b932672e453043c867cf8116e68cc2137eefb0169053731af2472d77bda26523f99ea4aaf237e0f58e3af44f95139979463923ae71531e63cbefdd00b2ab24
-
Filesize
30KB
MD5ebb785d0b91b2afef504bae462618240
SHA17dffde7e87b6ea8e516d10a5384dad71c9cc13ed
SHA25687b85937f3072e8f24245dc9e0f59e11dba0e550f9708756e2c74f65c07c0f93
SHA512d8b85c6021216dd6000110c3ca08aa9cfa00ee9ee8a5a42169b5144a7b7f93257ae36da708529d2bce2be4fcdbe944b6ce8730908dbfbf696a3d2669fdb0739a
-
Filesize
392B
MD5a5e7530b951fc78b6f532730f3372f13
SHA1fc647ae0574195bffc8d9d783ce91c5d60e46cdb
SHA256efc6edd73acaae3c50356df4c9856888b7aeae92401d94303a3c6a7c28f17724
SHA512f48fa9932d7453078f2bd17e022edd117066ba6e40c2bb76dbd023162650f5a73bf4e8100c8e654c9761843ed5bf840070846e8e0d6454d52fd0852ab0586d07
-
Filesize
392B
MD53b84a29bcfd9e8db1094a0665d7d1972
SHA125e1bb6aac60a686475f3b0b570398a80a740472
SHA2567212759b8c760c6ee81d69dae035afe9a584e995aa145948190e0591af8cae2b
SHA5126ae83324aa4e2b3b6b9f1bedc1c496991a8cda3c97505a0d77dbe44d901341147141807234f800fd3a7578e64ec978abd8970d68e297aed6934aef6a9e690213
-
Filesize
392B
MD5201bc2448e9766a0611460da1647c8b6
SHA15654f1ce7fbb743885db1babe41587ce72f814c7
SHA256ad89a29d11ec134e4fb5a690abfd1ed3dafb8cb3af07beedf1f78c3fe8542b0b
SHA5122760140fd4662aee46d50e0285d2a5813f81cfdf100143fe814e7ba04551c7c3f289668357dadbed267e18deb31f891d6dad141cbcff2b750f3f1bee76438bde
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Filesize2KB
MD5f2d5df2895dc16fe5ef8e381c0d3eb50
SHA1cc0ed68dd665963d4fbf65fa64822464540e69a8
SHA256dd2f8013951e83c25b059e7ac507bb5649cf554e62dfb3823a13bd2a0a397230
SHA512deb30d94a9a4f84e4017588e63182dd9c3fd54dddfe709bdca58252e4fd5efc680868afd9addd288e376495bfc744c8338fad7cfb56eb699828fdcd676b06a62
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
10KB
MD578e47dda17341bed7be45dccfd89ac87
SHA11afde30e46997452d11e4a2adbbf35cce7a1404f
SHA25667d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
SHA5129574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2476_1982024382\9b629488-b379-423b-9ffc-0ddd4fc184a5.tmp
Filesize152KB
MD5dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA256fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
SHA51265347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
-
Filesize
83KB
MD58813125a606768fdf8df506029daa16f
SHA148e825f14522bd4d149ef8b426af81eec0287947
SHA256323060680fed9a3205e3e36d2b62b7b5b6c6e6245e4555dcc733cf6ef390f41c
SHA5129486a027029a27cbf0424760625c08d73aa62e28e45081751c5bada7c07ca05b4e44239da7774cf4f76298fb6b71769ae62595ae439b470c8308d39e1b2289d8