phorphiex | hxxp://178[.]16[.]54[.]109/64[.]exe

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
41s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://178.16.54.109/64.exe
Sample260712-whf9fsey5p

Score

10^/10

discovery phorphiex loader trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.54.109

Signatures

Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Downloads MZ/PE file 1 IoCs

flow	pid	Process
35	2660	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1352	64.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2660	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283525234809600"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{C7BC26C5-8A0A-4B4D-BD5C-8F4886410829}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	taskmgr.exe
Token: SeSystemProfilePrivilege	1844	taskmgr.exe
Token: SeCreateGlobalPrivilege	1844	taskmgr.exe
Token: SeSecurityPrivilege	1844	taskmgr.exe
Token: SeTakeOwnershipPrivilege	1844	taskmgr.exe
Token: SeBackupPrivilege	4860	svchost.exe
Token: SeRestorePrivilege	4860	svchost.exe
Token: SeSecurityPrivilege	4860	svchost.exe
Token: SeTakeOwnershipPrivilege	4860	svchost.exe
Token: 35	4860	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe
1844	taskmgr.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1068	2456	msedge.exe	85
PID 2456 wrote to memory of 2660	2456	msedge.exe	86
PID 2456 wrote to memory of 1416	2456	msedge.exe	87
PID 2456 wrote to memory of 1416	2456	msedge.exe	87
PID 2456 wrote to memory of 1416	2456	msedge.exe	87
PID 2456 wrote to memory of 392	2456	msedge.exe	88
PID 2456 wrote to memory of 392	2456	msedge.exe	88
PID 2456 wrote to memory of 4060	2456	msedge.exe	89
PID 2456 wrote to memory of 4060	2456	msedge.exe	89
PID 2456 wrote to memory of 4060	2456	msedge.exe	89
PID 2456 wrote to memory of 3152	2456	msedge.exe	90
PID 2456 wrote to memory of 3152	2456	msedge.exe	90
PID 2456 wrote to memory of 3152	2456	msedge.exe	90
PID 2456 wrote to memory of 2480	2456	msedge.exe	92
PID 2456 wrote to memory of 2480	2456	msedge.exe	92
PID 2456 wrote to memory of 2480	2456	msedge.exe	92
PID 2456 wrote to memory of 4628	2456	msedge.exe	93
PID 2456 wrote to memory of 4628	2456	msedge.exe	93
PID 2456 wrote to memory of 4628	2456	msedge.exe	93
PID 2456 wrote to memory of 3552	2456	msedge.exe	98
PID 2456 wrote to memory of 5096	2456	msedge.exe	99
PID 2456 wrote to memory of 3552	2456	msedge.exe	98
PID 2456 wrote to memory of 5096	2456	msedge.exe	99
PID 2456 wrote to memory of 880	2456	msedge.exe	100
PID 2456 wrote to memory of 880	2456	msedge.exe	100
PID 2456 wrote to memory of 4392	2456	msedge.exe	101
PID 2456 wrote to memory of 4392	2456	msedge.exe	101
PID 2456 wrote to memory of 4392	2456	msedge.exe	101
PID 2456 wrote to memory of 4852	2456	msedge.exe	102
PID 2456 wrote to memory of 2352	2456	msedge.exe	104
PID 2456 wrote to memory of 1352	2456	msedge.exe	105

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://178.16.54.109/64.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x2b4,0x7ffc9cffc188,0x7ffc9cffc194,0x7ffc9cffc1a0
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,3757983216230756969,10665002805742918170,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2767031420555574571,9065503636415177871,262144 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,6399939345871514772,14260319813800913991,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,18274291718421174801,12614313013023714225,2097152 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15681697955238129659,5401343898406204184,2097152 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17069990598051269258,17972112564440410770,2097152 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,11037587631652015637,9664513448043547106,2097152 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,16274273304159341913,6359689015297685826,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3809138293862367333,14878847638621117074,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,10647075848209079717,12506449200901684698,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5724,i,4604636605977715011,15402485737059757937,2097152 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4570587735615467857,1422345815583750808,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,5559831197998987674,15609486567384795042,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,5559831197998987674,15609486567384795042,524288 --field-trial-handle=2300,i,8862025711782201621,4411582572307576050,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2352
- C:\Users\Admin\Downloads\64.exe
  "C:\Users\Admin\Downloads\64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:312

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae10af80c983ecdad438965cb208911f945e43bc36fe488247e2cd8bad97b450
MD5 f5ccd04bc3cab603843f2aa41a035cdb
SHA1 a4745772a8bc8f2c6e201e674b2ae558abaeb5f0
SHA512 e655264449a4bb6b25d28102be4b80887fc34a446f6baa3f02657035b3c41c200becbfdfe3947962121baf11f7b7315d8b709736af52453e82162331001d4608
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T121B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 212b592c15876ec390040373fa198f912dc0a95b11f67f210b703bf6d9451165
MD5 50a181d74d83b2bf26588f25dbc3fe79
SHA1 9ef94acf8a9520d4e1d516d94a6615d784579e7f
SHA512 72794c62ec6ac2966d8504a5016a346bdae6b7872eeb15a6a721b7ad871657e0f1a04866f0c487fc11c6ae5010c73be4d464350a2ee59c16481bbb35977f8a16
TLSH
T111D023603375F846D71811B1B5228F4177265451316FC106D195890F5D7A1D547D73C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 08e4412ee58d189a399bedc6b714c56dc974afe81c513935e4f2b16ec0b2da7c
MD5 59a90cf349c2774069a2ff64a0885e99
SHA1 f2cce303415e1d41a40212244459b2c281ec63b2
SHA512 f36bc828c50c21c7cce631528c3ec18316b930fd86e8151fbfaa803dfbdc227f0ec5657bdc9450550cae41f1d0a487c6de347717d02556890563021dc07431d4
TLSH
T1667193D403C5759EF3A23973D2D232917770D1CA1E437E480154A8FC9AD6BF5AB1AC18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5841e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5841e6.TMP
Size 3KB
SHA256 0893fa4a3c63f499bbd3490e0902ec3845d1a556f38dfe4ae50f3a8ea6c0425a
MD5 01326da8faa211e511316a6a5463a30a
SHA1 977a951272d1cb2c80e63aa7b2b9bb572ebc8e75
SHA512 492c6e85fd824f5b6c340e9287b5f10a0666d6fcf6f1a984c784f338f51929a85f6c3d972a5db8151eb923c502fd3ef206d1c12d1b10864ed01e6b3183ace0e8
TLSH
T1E37181D403C6759EF3A23973D2D232917770D1CA1E43BE490154A8FCAAD6BF5AB1AC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03612a08-4c2e-4794-abd7-cbbcdad36842.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\03612a08-4c2e-4794-abd7-cbbcdad36842.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 27f6e01bc765769cee08ce18f5fb08e52d8c5602373235676e5e786e9c28a6ce
MD5 e0822fd684114f63cc40c6644624262f
SHA1 2e17a0e600160312433a94985c2d95c9d4a1f395
SHA512 dd12f54aaadbb4b97b5591c7283053b1054802e97f5c29946f2e2e7a6660ef8b519076021591bc5e7d68a3a773266d77c54f0d7d631635eac6ff0d3d78878576
TLSH
T1B0117AB3C3D585AE890116F06A24AE2BCE2D0606432C7C198AD4FF2BD3F3475E00295F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f24f0f997ac69d1f7ffac96906b330fd3e86ce87332b747eaa2459dca42e2fe
MD5 a0d2eab8792dd9790c51aee8a26578d2
SHA1 6ab7a24ea50a588ca7516fa6da18aa5eb0bd1367
SHA512 5e2c3c687ae4a489e7d279f049479ab8904378beff7c9bc8093ae91c1686c17c997dfe8ecdde1f26ffe1fb0243e1a250d2310d6ddd5c9e7c7638e3bf458ca8c1
SSDEEP 192:sxZlURQyM/jK1Ml8M9l/f0sMYvIdpJHSU6+WNGYLl2zOIgrJ:sxZlUG1l/f0sMYAJHwGm9
TLSH
T17F42DA166A349977CCDBD209FA45BF53D6F91472E2901E44AAFCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bbcb82a2a7894a11dbd8c56cf90e5b1eb9487938586c8430e4a1cdf057707286
MD5 10d45d841a011534af543e27ad10a739
SHA1 bb6e25c6d442a69da555cb2c16622dd0e43e154b
SHA512 8501af6569526ec27bcd07ea37562584d6ad27024607f8d93ad2c469f757699df2e6a980d4d132f78a0135759eef892e63699b1fc9c1021608c167d5306487c9
SSDEEP 192:sxZlURQyM/jK1Ml8y9l/f0sVWpV5YvIdpJHSU6+WNGYLXEKoIgFJ:sxZlUGFl/f0sVWv5YAJHwGNv
TLSH
T1B352F9126A349977CCDBD20DFA55BF53D6F90472E2901E849AFCCA0C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0881874382de9616667d0f2292eeb569eaaddeb6017a5bf03f9a97f1a9948480
MD5 b80fb34e233a73728daadcbeec6d0572
SHA1 805bba9cebc66962b60dc823798d6a39a78f544e
SHA512 63c20d719e8266571e5dc67e5345d8ecfbae712e7d12a67e9798bbc1d941d323102f71d1859a55ccb4c47b36d157e85bd2e36d242f968b36ed35f9b00ecc13e8
SSDEEP 768:yIs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNJro0o:yIs6pD1WvxzWju1jahILIsNi0o
TLSH
T1BDD2FB3B680CC77E4F840E5CEC2AAF967DD801CBAB54899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 82ec4f1d4f052d23d37c78a36fbd4412f33d30b1dea19710135ea2189bea8b16
MD5 a41535474d0a31d5824ff497d2e2abaa
SHA1 27192ae67bb20533db7acf6f72c9648d88440a0c
SHA512 2aa1bf6bb6000db61e6e7b666e68d74782a286c2d2c905d3cd1f10154dd29d081749d472ce7feab8c60e3219e7d90375a99ccf95730a81d650e853587fb23dc5
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyF9IVK2QwHytnIlKUU4fyxsInKxWsm:KUAAKtePW9OK2QSOn2KUUiisoKxWF
TLSH
T124C1154236B702123C3E390893A497279B82F6633014ED6B7FA860755E66E384DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e2b80a516c5f25059e3c3d0daf0b1537914f153e30a04cd4198a4a80de1b9ebc
MD5 d71f2c7ab368ce150336de39bf8becb1
SHA1 0f3967de6a6b4eaf3702a27bbee98a894a14df53
SHA512 5fb533a230c1a557c2f637d73d8c0611757f2bceed01589fb1d0753e29304a206800b923b5d998221cdaa21cee2bad4874dd812dfa3292adb718b3eda281c246
SSDEEP 384:wtNn/s3n9S+sNiznKpU1L4a9gO2MHW+JLDVcl1lIO7w/hw9BV:wj+9R0mLhuOBvJLDVcLCO7w/h4
TLSH
T15D927D329879AC7759E2A245F547360B9FF98077C6C62F90D6CDAF0D00CF6AC130691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37184ae10ce0d8ea5ef438f4add856e74eaae4de10c676475c6d47c2bad44ba6
MD5 5c7541a1bb21e19db8a82003cf840969
SHA1 bb1a239c01ef7f7973fb5bcb416cd99b15002020
SHA512 9b55f8e30773a9f7e348d522b628315c75d17ec4ffb371ba1ba17e98cfd5693af7c229ff200d37ab0dd3915a0a2b7b026b2129e96fdc7bd1e4582e951282b6d6
SSDEEP 192:qON3EV6O7+3hQmiUytoOGttb05O29h2qgGJeU6:qONC61UGt9gO2MsEU6
TLSH
T14502F9356C386CB75AF3AE46F98737275FA5102BE9962F80D6D81F0C00DB65C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b4198350716e4b534cb6192aa88b3ea6e2bac951c59d28437fcda61501db1169
MD5 dfe97fca667ef1909bdc9cf2da499e66
SHA1 1de145b6094135bd6c25d54db3ad794f67606f84
SHA512 48cf558cb14538fcc83b1754ab415c5a32c23d4168270760fdae55a045cf9db35e64e54fe66894107980bbf19fa272af8d6e8875e4e32904d3aa9c575e91bb23
SSDEEP 384:rtNn/s3n9SWsNiznKpzhL4a9gO2MHW+wSvFA8Bvt1o7qKkBxDVcl1lIO7w/hw9BV:rj+9F0DLhuOBvD68m7qtxDVcLCO7w/h4
TLSH
T170C27B71D4A46CE74491E6C8B547F50B6EB84177C68E1A5CE2FCBB3D308FAB84312929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a124f5e9c4050e7ffcb4226980088c6e540afbbc733c7eb87b30baa50ebeec71
MD5 20335bc6be25ab61fe9a1f1804025baa
SHA1 6c73bef281a91d9fd5c52c7cfd9083777d018fd6
SHA512 81672cb053b99e1fc871da8cda25b508ac030a533bda03ae7d4104a16932d7a6f2b4fac210067eb45b1d45f00af20c67e9e67ad02d72c5048465ec01effb74da
SSDEEP 192:bONb6O7+3oQmiUytqO0ttb05O29h2HoNdcN6qWyLU6:bONb6yQ0t9gO2MHW6JLU6
TLSH
T1BE122B326C689C676EF3A145F58736178FA54177DB866F80D6DC2E0C01EF6AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7cb3e8ada5fa218c172d4c1ead719227d7a6cd72cacc3ae9dcdf4178902ced75
MD5 d2ae038b1573df260fe06f3bb69dd50b
SHA1 ea020168af4197fdeac354d74ac7009dde214d8f
SHA512 bda4b680959d5a60cc8cc06852a3dc0f1629bd92bfc3675706a38a8eaa4ad0c50a22ca78d1c5a22426d4b5a32b793ecba28845d1b5184a33c7db430469d29fe2
TLSH
T141414768AAEA1118B7B76F56ABF6B96D547FB8333F0BD45D00110D4E0A23A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

64.exe

Path C:\Users\Admin\Downloads\64.exe
Size 12KB
SHA256 8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
MD5 362fc53afbda6450184b73746802a6fa
SHA1 4c289f978c4c464da05cee4c33101ea7f5291d7b
SHA512 d137b29e9a9ae7ec47dcdb6733e618566cb66d910e33058c5681b61cd3ef0d07e346d4cee19f39c0e1e6918215bb5281caaa5fac204156f46b37c2b63e1b7c81
SSDEEP 192:yW0eU9Y0G5msXhBee6JPJXJxTNerBthIHMzQoh:P0TYgsXhAh9xBerBgMz
TLSH
T11742290AA8091831F3E204B2573E82938BBD19A337D5F9DBFB8067090DB53D5D17966E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1844-305-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-297-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-298-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-296-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-308-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-307-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-306-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-304-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-303-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-302-0x00000194047B0000-0x00000194047B1000-memory.dmp

Download

memory/1844-315-0x00000194035B0000-0x00000194035C0000-memory.dmp

Download

memory/1844-309-0x0000019403550000-0x0000019403560000-memory.dmp

Download