3a186b7a992516bb19f9948d4470c4716ed4b070249a7f6f3d1a28817a1b2ae4

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2025, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe
Size 4.0MB
Sample250517-s77k6awkz4
SHA256 3a186b7a992516bb19f9948d4470c4716ed4b070249a7f6f3d1a28817a1b2ae4
MD5 00dcca2bfebb197718197a4337259e9d
SHA1 c91d6a05fbdd30fbd96481da7e6c21b216be3e0c
SHA512 b0d1c0edad773d512177204a90cf0a98bd79194f7b780323d5ce687b93c63ea3324649853e2d3f3e738fc23e89ba9c65e422a7d53fba6e277d911c1229b0f5c9
SSDEEP 49152:zjNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:zRzP88fBsnZTgOtqB3m1RC3
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_257729530\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_257729530\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_1669419241\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_121164766\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_121164766\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_121164766\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_257729530\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_1669419241\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_257729530\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_1669419241\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_121164766\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_121164766\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2956_257729530\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133919704424690646"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2930597513-779029253-718817275-1000\{E49D89F2-1480-4670-B73A-BCEF9D00D825}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2956	1404	2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe	100
PID 1404 wrote to memory of 2956	1404	2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe	100
PID 2956 wrote to memory of 5296	2956	msedge.exe	101
PID 2956 wrote to memory of 5296	2956	msedge.exe	101
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 1072	2956	msedge.exe	103
PID 2956 wrote to memory of 1072	2956	msedge.exe	103
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 3200	2956	msedge.exe	102
PID 2956 wrote to memory of 5520	2956	msedge.exe	105
PID 2956 wrote to memory of 5520	2956	msedge.exe	105
PID 2956 wrote to memory of 5520	2956	msedge.exe	105
PID 2956 wrote to memory of 5520	2956	msedge.exe	105
PID 2956 wrote to memory of 5520	2956	msedge.exe	105
PID 2956 wrote to memory of 5520	2956	msedge.exe	105
PID 2956 wrote to memory of 5520	2956	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2f0,0x7ffc39aef208,0x7ffc39aef214,0x7ffc39aef220
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2412,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1844,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2492,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2796,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4780,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4772,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4716,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5676,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5936,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5936,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6336,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6480,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6460,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5340,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4264,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5808,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=880,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5508,i,9784021142632332620,14120422847945703495,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
    3⤵
    PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2956_257729530\manifest.json
Size 176B
SHA256 4474f08d1718da148ddb55aeb998886c053f6539c2fee3b3b1796f3855792ff9
MD5 778202dc964e7fb0ab5bed004f33fb14
SHA1 932ed013275e2c1172575885246c937c7cca87af
SHA512 9105af9928af4bcceb2cdc2161137ef6b07f4b97d663bbf27086f80dd266e967a5524aa5aec3f457493a0c4b98aa092aac6bd5062e72cbd4d939402c92093948
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\keys.json
Size 7KB
SHA256 f967e18d5b1839ba801212f032e7e6dd92f7ba6958bc3ae9b122d9fadf2b1bf4
MD5 03f15dff10ac451682f8a308674ddf77
SHA1 c723e23c49bed8a52b8f947b2cb8879a110fc94b
SHA512 df8fdc89cc1e6f2edce49b41bd9f71dc7f7a8daab40f1355415119f9c0a0d5067337d966472ad49f855ecb9a89bee8d1711d8a869589a03e469530ee8d7e0f3e
SSDEEP 96:UXq6pG2GE+Vy2+yzdswsDm4+m0plhYvPuW+wkpTm+ozdswsDm4+uTaQSfmXAgz+y:uNtGbVKyR9Pm4lOvMwkoR9PuGMXcy
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2956_694826364\manifest.json
Size 79B
SHA256 6722a860c855cf94a54fd1ffdd3801c4c949f5b67d8601ad300264931057f2bb
MD5 89217e000f3145a2523e43f947208e79
SHA1 cd7915d003ee87f2babc9ee9add12841022710ac
SHA512 385257ef9c67d80006eb350ac79718f30e08d810a1568454806f2505b482e0093f784d0d4cd24078317f863db500898343ce69391c0ae7fc767697f6da38eeaf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27c484d097aae1bca38e8f1172adaa5c90d9268faa338055b4088f0fe4d30cd9
MD5 eac6f7a4e3cecaccba4d55d9bb4a4aa5
SHA1 dd16efcde93b21b9893e8400cd09b9e9ff7f577d
SHA512 71ee4f257387ad8ac3b5b63bbec39ed6967f6f5ca08b30e47025972ae81441ec152f3927257af5988da3c97b064c094b2d16755a80d082b64d9e5190316c79fa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 644d4857a1c6aea7f00047f680f73268a9ec9b4723e8883634838ba7e85a371f
MD5 ebec76aed13d5d88d6d42bc3cfdbbe5a
SHA1 35017c0da2f42fdb5e0e2e473093c930c5a4b8a3
SHA512 94d43e138f5191f49ccb53e346941e6460eae9d0febac5c5b7cbeb53c13d3f7aab86f9c7b2508c63d8ee4181b0c98488ef31b21a44317f3927654040a7081c4c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5842d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5842d0.TMP
Size 3KB
SHA256 aa5a4e14fbc1868b00fdaa339f163517334b4111f283302da1111009c49176e7
MD5 ccc7a1a2cf51c493f13cf269ae044d27
SHA1 4ff97d47ffcfdb74ed010ab49db17bc21b2bab36
SHA512 29ee3f73dc0335726e32e010d50463cb5e73cf6e894796c35a7dd224a73a33cdc16d39241bc04d98f4354ec37bc31e45cb5e2168069c66b7d54e2ba9a766b8dd
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 138045e7cafc23d908b8d95e7948dc052dc582ba8a6cf66e0e75f990ff3ee147
MD5 28a18478fb9924cec0f8112e598f8ffe
SHA1 30369b68d7fb0e049a857bc243211d80a5269f2e
SHA512 1e703dcbe85325f589905f129f4d96e9cbde6e556b3e45f0f3edc3e153d2da602ff82005d5c88e173e955e64902698ee89ada6981821dd4cde1f998438c3a6be
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c49a4be2e32164f228061541d8401a341c4dba24ad96e43b364e84afd170dc76
MD5 f8677e649687d8c01cea9887d900852c
SHA1 ac48806d1ca94086644d8fe5d387a2df1b2ea6d1
SHA512 fe2f63e1e1d963c8bd1486b6c972b209fa5a5a561a4562ec9570159d6846b77406f74e75c3cd1aac024419c42a5b1359a15dfda84aa43670322442d84fbd7835
SSDEEP 192:sVBRjyMqv/Ky0Ml8UQjgcsxfaYcwhljwIl0QKWYg4VPNzoZ8pdHY+WNAKQIF4wnl:sVB+LqkcsxShwljZ+5yYdHSVQqEiO6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ede92e403f76eb8e6fb44c71a8fbc866121ca44dfe06e667e1b4893db16e831f
MD5 2793f54bdf8ef05640fe739c61df78ab
SHA1 48634c80e404094a7e3a73bbb3195baac8b1e5c4
SHA512 18319eb126db9e29889c1d3ccf459629f59ca7b93a600778d755889b56fde29c90622187a6ce94c2f536d47deba9ae64ce7205b73f5e5af7e46c3ef5de6e0392
SSDEEP 384:sVB+LIcsxShwljZk5yZaKHS1UrwBPEiOdT:s3vhShWjZkIHSvlEf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 e0e6f0b31f08c4545a29070ebd69b4682788b17077083446c00432982340878c
MD5 a802c4bdb5ed35591ffeca0ced19a210
SHA1 07bfd64bbcf82549a34c67c00e3feb524f96c02f
SHA512 2c7b84965adda22a81fb48d9ba3f56bd3fd981a463cb8b3f63fed3c4cb03e8eeb870258d5b97d3b70a6cd92328c83365a8b9dd094123c11c62a4537d4ed673c9
SSDEEP 768:v+5c+HY7pLuLDTRWFLZbl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVz5F+LlSUzuYroL:v+5c+HEEDTRWFLZblu1jaI5F+LEqujK0
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 baf62e627d5b1ef83f74009b1509f69da709566e7f0bf2e6eb53933eeef24c59
MD5 ed6ae1a3ab07df543d8f4ce687f3d774
SHA1 3f6a790af284db0f2b72671b5de91c55ff7a3b5e
SHA512 ce53fdc2fcee93f6724e93401f6cbb79663abdfb3c170266e4cbfd1e9c349be8e811ac673a37e48e08412f490f799123b6336d9d285a8affefde899c4fef8ee8
SSDEEP 192:jAx4AkVm2A5C+Jae0scDsveeuAA+XwX+nt:H+Jae0scDsveeuAA+XwX+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 18f842971285cda71ddc91363d6f05e91a4b68598ff82c8efb7212aabe3642a8
MD5 97896d21e4270e1484c6f0114d831a0a
SHA1 2bb9b3110e983e776975a4b4091e84710edd43d6
SHA512 c5b4726a054ed2d65cac794adf0dcc2dc0ac86b142934b6c9c9927d01b4dd16b3b2340be941db00c34e48fe2790a0351e463d69770af2707a4f16b3e3968ea88
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9d79a9b21c5790df8594bf0cd4a99b50682caac6fab007e8d7e4776553ad05ee
MD5 e130efd4591e11053dec6afe8fe0f2fd
SHA1 2dc64f6a728a8a6659daa7469b85695ff0a8850b
SHA512 9b41b7f006374a800f475664c7305c30990439883f4a8f13ee3574c817de0da9b154ea7496e55541ae9f033fdb5d9bba2ff8779938ef0780740b1bb942867822
SSDEEP 768:DQiE6esE8lDldUGz3EwgpbpkHXLJUaWZmNKFV1xvDn/9Qz0kCY6Bd:3eB85d73gjj1JD/K4Y6Bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 eebedfb5966550789f80d7ff90e35bd62aba0aba15c5f7a1de0ec906ca448951
MD5 326edfbd412c39a6f1a8e4f8c07e0b6b
SHA1 9cb992cc1b001677eddda46811bd31eae8bb559e
SHA512 da65af4608c849937d8fe305d6b0efe4777468f0327d90f1fbcb44152805d75e9482b5ef681e8a802caee1c2651cf2aaf29e2d54c6ec70a0df33b21b19c6f64e
SSDEEP 768:cQiE6esE8lDldUGv3PwgCbp11XLJUaWx/XDqj+5y9/9Qz0kCY6aqd:IeB85d338+XD6XNK4Y61d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 55e7340af33c9615400d27e4e8b9cd687c7bf1f06364886785edb4f0942ca3f0
MD5 d4dab2b95cedcbd4ac7c283ef069cede
SHA1 0b58b286767219179609c4a57ef8dbd05b528b22
SHA512 36db5e8e22fbb3cea1b81705aef5bda103461c8f8f7796d307de90d81fe7b2577faf7f6f312ea78b1188278c33bfc75414dd64ccd1993e764321c6dcaf2a26ef
SSDEEP 768:cQPE6esE8lDldUGw3PwgCbp4TxXLJUaWx/XDqj+QyLb/LMiZCY6DA/9Qz0BH:TeB85dI38ZXD6eLbjuY6DiKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 53KB
SHA256 90b58476bb7ee5a6bb857c83d2556c2e207cc4ba9029d28abea2cdbd1cdec7b7
MD5 239015df980c6f49eaf80c404161e911
SHA1 20e3a1f147ebbad964abdbbe50e55f8e20911089
SHA512 31b42bcdb5e380fc0c2b1dc79f94ba1cd8d4b0f3dc96bf3b69be2fdbf4d12f9dfc0f2a28f4dcd1280f18c9ad0d54c6e92db255f435518c723a7f1994fc861c5b
SSDEEP 768:IQPE6esE8lDldUGv3PwgCbpfcTxXLJUaWx/XDqj+0yLb/LMiZCY6DA/9Qz0BH:feB85d3389XD6uLbjuY6DiKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 455694eda137bb50568d71b257fbddb327c824743eb24c95dcbc4461d9e40a28
MD5 a2e3112960722de771257d9255ead884
SHA1 32ccfe48159360a690e0080ef048f3eef6c08ea4
SHA512 bc3f961d8eb66c3ba65beecf539bbcc25c48966528dd804eb1952badcab9f834707c50fecb8b07cec318530b9999a5c4ce806ae5ebc48268a57c5767a6d74f13
SSDEEP 768:cQiE6esE8lDldUGw3PwgCbpE1XLJUaWx/XDqj+QyLb/LMiZCY6DA/9Qz0BH:YeB85dI38NXD6eLbjuY6DiKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9746d109f96465c33df1175da2d28b84c0d78d4a28bf0578c79644440ba323f3
MD5 4e3820229dda15e512a92bef4f8d9824
SHA1 1fb7ec4fbbd65030c8d6c646c927e0ce78fcf60b
SHA512 e08c8d7747313478c725093d05f5b86cac8a752d37a835c30691023c3a2d31b06eb6e7d17c244906bf02b4210526c26f442ca8de555e618204880cdfcc8ebf9c
MD5 SHA1 SHA512

Submit Download