hxxps://pentagon[.]cy

Resubmissions

27/03/2025, 07:16

250327-h357esyvct 10

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pentagon.cy

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5788_1902171776\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5788_1902171776\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5788_1902171776\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5788_1902171776\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5788_1902171776\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875334229776982"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{CA3E5761-21B8-4DB8-8626-B64E39F04810}	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5508	svchost.exe
Token: 33	1112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1112	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe
5788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 2452	5788	msedge.exe	86
PID 5788 wrote to memory of 2452	5788	msedge.exe	86
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 4280	5788	msedge.exe	88
PID 5788 wrote to memory of 4280	5788	msedge.exe	88
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 5068	5788	msedge.exe	87
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89
PID 5788 wrote to memory of 1476	5788	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pentagon.cy
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff97e63f208,0x7ff97e63f214,0x7ff97e63f220
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2272,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3520,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5004,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4804,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5388,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5660,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5436,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=4560,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6300,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3556,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5920,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5500,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6204,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=5476,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5252,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=4004,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6196,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6772,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6304,i,5133080685472432472,3412581514591444617,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x430 0x25c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5788_1902171776\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5788_1902171776\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
e4a7012bdcded282dea81066d7d6441c

SHA1
6d92a091ded62e2f0c38c0ad65307f6698da5f22

SHA256
c6772f55ed14fd9cb3f9fb472fc336f26f11b06932e2aa10d581bb0447cd584e

SHA512
aa58982c1edb7aad99e3048cb67d536c1f89fa0d884b5c3636c1e3a8acea7c9548adf7f0c401183c64ebe70d51b4b256f0c2e8cf14e59770324930d3ce807920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b1733caf8c06a6111589961d1f3190b2

SHA1
4cb891a66a1c6f1ef435cf448b7849aa6fd86456

SHA256
4ffca056a6b82f8434fd5d519a6f9b4bd891242524bc19d7d6c282e2f222a6ea

SHA512
dfd206f91f1a5aa67efd6de5cdeb57fe4193281afea9a9e82c84e0378569e5c4d53a741d6d99206dac8e00ee3b10959e5b81f1350957336e20857f96ab4a1ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
43d4b25139ddc5f54237bb5d8866d9e6

SHA1
50903128187e216ab04d846d9eef2e3fab6a0bea

SHA256
2e293aaeb442ea5f8c5ba031df55488873014990d6a6f59220fb7b59ff671c6d

SHA512
75dbab182f8641e232afc90b1f726dd858727f1acc9c04a86697a873218b59433c804d475ba9c9e4204da4a7b9a30c7639ccd6268099ac368e81b9f1d21c485a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
a74ba39fb423923cec7b270787da6877

SHA1
6dd893a3117444a54981ff9da51969cba0caf732

SHA256
d11bf855eca38f969f6f6f44b182173aebae944f196706aa147451e7206ccdb2

SHA512
88f0ac7d7907b5a72b0984d5dbd2851de47fe80f3af8f97b3ebb2a7b9d5dfb4f797365f927e1c20b05ef88faf1fee5d25a13fac90c2f28f865cb6c8b36a54109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f19b600a-d0bd-46e4-9b10-42f0f2bbf664.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
f18effcc8ad3307be7cf17b55f7823b7

SHA1
ba391a2d9cf1f315cf7c5976f183f3b841beeced

SHA256
9d3cf973d926213d6558b7df1f27b470603146977b6e94d4e769c3d00405922e

SHA512
c445c9e44ddecd179de9b4618a7f39a1e30bc18dfa5186e6f40f13fa3716ff90b71d02589eed6d68bae0fd0d0453a6a05bf66a7f24e3361578a7e916b753f897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
37956bc2962b4971f4a75919f7858d24

SHA1
79ea5e8ff6811535cae7000abe43711b283c19e6

SHA256
a562960b48d38c3290dec1277f5b0a46d3bb056adb2e32989ee3924cd77883b3

SHA512
15754d931dd41bb8421d8cb8b8070fbbe9d002f7b82abf0786260aca7237cc7c95e8bc8fb68c99ddea0f21388a596dac6760b12f63433201ceeae8252e93e126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
60d575ed4c847756a0a034808a94e9a6

SHA1
5678651231ba9ec09e6180ba205c8a97d7c251f2

SHA256
58b039ef3c2e2c386f4b472014140b3f3dba497329a5b8f20aedf6e319ad4066

SHA512
d5fdd9f51cf092797c334a83349b51efe463cfcb6123ad1fd2d41f6745e07078ac439f505823c5de64c576b6a1748572df264560a4b0a4f22baa30226f67a828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
30a7fbdf1376f4afcb500f293b4ce72b

SHA1
73a49485fdf8efda016bc1c6984966edcd451306

SHA256
c2505ee02f6017301e83b5de66351b417e3a71712b22ff2e0321d4f6c22efb7f

SHA512
81bcce03a57f13d7d8b546212817096b1f4344a063275640cbf1cba803fdb040d50e914a47e9007a66a9927662cf82e1cfcf5e848852aa7179285bf4dbe3e91a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
bdb666d88a1994fbdcf36140179cad3e

SHA1
cda2d4f93a0d9a4e20bbc81fb959d4b889f1cd11

SHA256
fa90c0519bc7aaee9fc2146d53d3d2c4e1f5d4ffd2bf27c24ef9b042ae3f2faf

SHA512
5eac8aa94f9ec176ecdc55f07b8e634ad5f3e2b4e0450557c9cd45beff604e5b7c3d4c45fc83d0449becc39ed6e6a45e9afa0c92bfa6629b7526ead7ce6c99c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
5606a464bfc5fdace5578bcdda615d44

SHA1
8dffcb734bc94c893eac37d6a6e1205195ad54cc

SHA256
27ce2740d0796a7dbdc823aeb5dd3f1cae17e8db991c15109d22797d42763486

SHA512
4e869ca3c6ca925a4aa54871cf22893a1975378203bfdfd0fb103437b412c6e5de83a9abbc837f86f6d12501a40602e4d2499fcc283b33b6acc593fab9deaf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
0b28ceb67f78950f76295c00b28ed650

SHA1
70ea0e377b102e03ab0dd6d20530f53c13ef80e7

SHA256
f83fea427e0f85dd63316b6518b7815906bb4d73d7c6dfb340b5cf73ff4e5c9b

SHA512
60c8a9dfcaf0b27eff1042ab684cc41a72e91738f69374a58f4dd07ed073c97ad49221e1d165fcf1ee5c379981c498959cd0cd1c7b11498ee0b6ce7e0e9042b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
16a7ffec44886c69c668be763192b269

SHA1
9757be8cfbe9689ea67a6e9fa2a11a175714a962

SHA256
59be67047275b83a765797467a3b70bab9b30abae4a5b500c208cb616fa82619

SHA512
8a211a5da04a9083180e22b61c58cc9732cba037f7c8e5850f943b31d928633717dd2bcd07fe7f31bb391c4bf1be0f6a9d39e9cedebe9900e4890fa3233ed4a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
a3053f8fc4eedb2f4da857d3eeb40c7a

SHA1
ad45762efe5390de5a6952c14cddb4c4b4e49ecc

SHA256
3bb5edcfa66b1c65540cf7b010b4b1d59b6fd7d56b5b086892b6f7579ca1d81e

SHA512
dd96766ad22bb184edfac63e2c748885b11329f0b87eefe406946892e9e2683dfa4068c84d074718cfe1ecad05ad536e90e56127402460c149aee07256687719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
8c3a876eb38caa39baebb477242890b6

SHA1
512e22eedd72fbc80b60f25c5580b9612b4e334e

SHA256
239925b7ccbf5dbb87dc06e849ccc1106ca07cbeb30818e3b53e35ab8b227cb2

SHA512
1eb91090ec181d5c54b51e6262246e5edd9a1f9b77eba1e81ee60d6f212519b411b895cf537820acca3f95dcec2bf3774738c4d3a0c58d87f445cc472af96244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
e32158dd9191014364b484da7e2903b5

SHA1
0e5e5e7f73726533eac47bbd1bd71bf7d59e8e62

SHA256
daaff5677f8aafa8b43bc3e30af0e7aad51624ad84140939f664238483b07217

SHA512
95d4e8b6a7f98db6b6c47b9c68ea423c389f1717d26ec2d79c737c9fa912b3c6f6cc228f0dcf24fb94e91af77f18fc5156675a4e08e944816df51bd69c29fad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe584188.TMP

Filesize
392B

MD5
908c997baf608de0e096f3b046802ae8

SHA1
90f2c44f6eb11a9bd8cacda93ac5fa43832ca873

SHA256
b735486ef21958e3960a4bc5c559f16d4220c9270e277dfe95398cfc4544441e

SHA512
d3ef9c6ebd7e9be1c688e4b62b634b65e84d6850f4c76f72a1514a992f5d013286757796a44199f482292afbb872ad07e7c20ef82663da969c116470d7e5271f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
65b6ac5f83f661771d280006ac3f8b8d

SHA1
835e4b0a94d55cdc1d7dd18d108b6c9ac2fe52c3

SHA256
475ffd341dc924d695a284d1e125e7e5b2fe426dece816a3da4b55ecd253f3c6

SHA512
3fe9098e31480110a0d0b8567f1a44bf585455b7a777c6f2e083ccb2481423efac0196a20915049def22630660788dd31a08733dc7f0c2be88c8420001adca66

Download Submit
memory/5508-161-0x000001F1926B0000-0x000001F1926C0000-memory.dmp

Filesize
64KB

Download
memory/5508-207-0x000001F1A29F0000-0x000001F1A29F1000-memory.dmp

Filesize
4KB

Download
memory/5508-210-0x000001F1A29E0000-0x000001F1A29E1000-memory.dmp

Filesize
4KB

Download
memory/5508-213-0x000001F1A2920000-0x000001F1A2921000-memory.dmp

Filesize
4KB

Download
memory/5508-225-0x000001F1A2B20000-0x000001F1A2B21000-memory.dmp

Filesize
4KB

Download
memory/5508-205-0x000001F1A29E0000-0x000001F1A29E1000-memory.dmp

Filesize
4KB

Download
memory/5508-227-0x000001F1A2B30000-0x000001F1A2B31000-memory.dmp

Filesize
4KB

Download
memory/5508-228-0x000001F1A2B30000-0x000001F1A2B31000-memory.dmp

Filesize
4KB

Download
memory/5508-229-0x000001F1A2C40000-0x000001F1A2C41000-memory.dmp

Filesize
4KB

Download
memory/5508-204-0x000001F1A29F0000-0x000001F1A29F1000-memory.dmp

Filesize
4KB

Download
memory/5508-203-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-202-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-201-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-200-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-198-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-199-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-197-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-196-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-194-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-195-0x000001F1A2DD0000-0x000001F1A2DD1000-memory.dmp

Filesize
4KB

Download
memory/5508-193-0x000001F1A2DA0000-0x000001F1A2DA1000-memory.dmp

Filesize
4KB

Download
memory/5508-178-0x000001F1927C0000-0x000001F1927D0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads