hxxps://github[.]com/Spencer0187/Spencer-Macro-Utilities/releases/download/V3[.]2[.]1/suspend-3[.]2[.]1[.]exe

Analysis

user interaction
yes
max time kernel
38s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Spencer0187/Spencer-Macro-Utilities/releases/download/V3.2.1/suspend-3.2.1.exe
Sample260727-nbfeks1wes

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	976	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4220	suspend-3.2.1.exe
860	suspend-3.2.1.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Wine	suspend-3.2.1.exe
Key opened	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Wine	suspend-3.2.1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
976	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296243980230827"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\json_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\json_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.json	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\json_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{29B00BC8-FAEF-4A3A-88CF-680003A7D55C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\json_auto_file\shell	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4220	suspend-3.2.1.exe
4220	suspend-3.2.1.exe
860	suspend-3.2.1.exe
860	suspend-3.2.1.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4220	suspend-3.2.1.exe
860	suspend-3.2.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4220	suspend-3.2.1.exe
860	suspend-3.2.1.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
4844	OpenWith.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe
3908	AcroRd32.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 548	4804	msedge.exe	86
PID 4804 wrote to memory of 976	4804	msedge.exe	88
PID 4804 wrote to memory of 1232	4804	msedge.exe	89
PID 4804 wrote to memory of 1232	4804	msedge.exe	89
PID 4804 wrote to memory of 1232	4804	msedge.exe	89
PID 4804 wrote to memory of 3784	4804	msedge.exe	90
PID 4804 wrote to memory of 3784	4804	msedge.exe	90
PID 4804 wrote to memory of 3248	4804	msedge.exe	91
PID 4804 wrote to memory of 3640	4804	msedge.exe	92
PID 4804 wrote to memory of 3248	4804	msedge.exe	91
PID 4804 wrote to memory of 3248	4804	msedge.exe	91
PID 4804 wrote to memory of 3640	4804	msedge.exe	92
PID 4804 wrote to memory of 3640	4804	msedge.exe	92
PID 4804 wrote to memory of 4668	4804	msedge.exe	93
PID 4804 wrote to memory of 4668	4804	msedge.exe	93
PID 4804 wrote to memory of 4668	4804	msedge.exe	93
PID 4804 wrote to memory of 1248	4804	msedge.exe	94
PID 4804 wrote to memory of 1248	4804	msedge.exe	94
PID 4804 wrote to memory of 1248	4804	msedge.exe	94
PID 4804 wrote to memory of 2796	4804	msedge.exe	98
PID 4804 wrote to memory of 2988	4804	msedge.exe	99
PID 4804 wrote to memory of 2796	4804	msedge.exe	98
PID 4804 wrote to memory of 2988	4804	msedge.exe	99
PID 4804 wrote to memory of 4416	4804	msedge.exe	100
PID 4804 wrote to memory of 4416	4804	msedge.exe	100
PID 4804 wrote to memory of 4560	4804	msedge.exe	101
PID 4804 wrote to memory of 4560	4804	msedge.exe	101
PID 4804 wrote to memory of 4560	4804	msedge.exe	101
PID 4804 wrote to memory of 648	4804	msedge.exe	102
PID 4804 wrote to memory of 5096	4804	msedge.exe	103
PID 4804 wrote to memory of 5096	4804	msedge.exe	103
PID 4804 wrote to memory of 4920	4804	msedge.exe	106
PID 4804 wrote to memory of 4220	4804	msedge.exe	107
PID 4844 wrote to memory of 3908	4844	OpenWith.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Spencer0187/Spencer-Macro-Utilities/releases/download/V3.2.1/suspend-3.2.1.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffbfb32c188,0x7ffbfb32c194,0x7ffbfb32c1a0
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,17885970903423171852,15467836231614452000,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,12900515986657345815,8021687067936383922,262144 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,8327454986483547758,4394894284330925233,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,18227993321392086094,5781565371067387857,2097152 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,10719637023470696963,15634741750664613301,2097152 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,13573673951920583843,7687927908621026867,2097152 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,4656856874973738336,4331315436403663510,2097152 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,9758898206810699556,18286828582612678439,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2521350927395267853,15238705528765546473,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,17126413930831078669,7360643501903749772,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,17718177372003856610,16707958422664915334,2097152 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,2493105860898508884,17550215972366017148,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,6059204318466225833,3987837226155620721,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,18210287442626257978,15913389067498258056,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,18210287442626257978,15913389067498258056,524288 --field-trial-handle=2944,i,8922094357806543832,17732296232202595352,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4920
- C:\Users\Admin\Downloads\suspend-3.2.1.exe
  "C:\Users\Admin\Downloads\suspend-3.2.1.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2872

C:\Users\Admin\Downloads\suspend-3.2.1.exe
"C:\Users\Admin\Downloads\suspend-3.2.1.exe"
1⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\SMCSettings.json"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bb198c81963e699455b64b9ce7875c63551bac1db146ac9e8b16246add4890ae
MD5 e5b55006b588cbfd0a0c4801b2c1055a
SHA1 ddde08e8f44660d59ca273351189083ac43d8809
SHA512 453a760669986555d9c71b4c1e974d6f1c226d7ff4ac867acc428d6346dc81990eb139eda65972c93abd04637b774055ff3725b789c9ae8f2d1492ee6187b2dd
TLSH
T1DCD023707D35EBD6D11E10F45420494112374273315757B5B155584EDEB4081F2DFDF6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 90744ba87ba8a43875380e5d52f8a9114c1d20a19163b4b564ff0005e5651c28
MD5 8c360da7c8128ed02a15c64c3c6e95ab
SHA1 2d047910d16ee26803f4878748b91e0a8ec47676
SHA512 170b9b7154adcfd0ae65f36a7788e2d820efffea7626413df71b2a24b82d18a97c3c6d380a31448511c0ab71c89947e2e09ecad1def2fa3a7c1a1c6091c34521
TLSH
T1406192781B720756E366113FE0F0860CBB73C2EEF82B1E3E439028B9650DB944144D07
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58df9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58df9d.TMP
Size 3KB
SHA256 a45927fe63c7ae27af87714ff86dd9a789846773b5a4968e9af69ca16b8246c6
MD5 c7a99b7e628916fded98d4b6fc85b385
SHA1 2dd88d7d9609580b35680a9891f1b904ed284e22
SHA512 9d7b7c27740cf86b6ece04524a6cc01811d1703cc03ca29caba543881fefa45298ccf9de3170e3b610dce4ba004eb43d3bdf3a30f69093488b9e924701b7359b
TLSH
T1C56192781B720756E36A117BE0F0860CBB73C2EEF82B1E3E439029BA650DB944184D47
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 331cb6a2d385fbb41e1c4d6b54ef7cf074281a07200175693c86d46dbea96bfb
MD5 673d9a3d3f3ecd950da899096e25c42f
SHA1 a2348411b8de8df833f0ceac44064fa5f7c8c1d5
SHA512 55079613a0f735a30ee79e7b9c498293bb78346a1d64c58ddb52c7d82ef8c581826b0e7effef51463b7d4fd65401af66c1e6ff09133ef997e2cd6a8a400e617b
TLSH
T18E21C0F7C7E5856E8A0157F0AA18AE1BCE2D0512831C7C2985E4AF27D3F3475E102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ecf63d2daf98f30db6915716cfc0298666b66aee25a1a68294b3084564496acd
MD5 09f0181d7d36b545bc75baa8b3932553
SHA1 e259aa31f8e4d91582b9ec387dcc529ae43e8e15
SHA512 284851c550152cee1dfcb7cbbc3b60f01ee2dbce922908f39da869d3113c0525968ac3e6be781876389a8a117c7d0b9918d693d4fd501c28550fb8cd162c6ee2
SSDEEP 192:sxZHRP96/fMsaPS6cIdpJHW6+WNGY9IocTDkIgrJ:sxZHX6/fMsaK2JHbG9I9
TLSH
T13422A6166E38A57B8CCBD209BA55BF03E6F95032A1D51E58EAFC860C04EBADD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6528524bedf5ea5d66476588e3ed92b382266a741c4f7f175f3d95584122c771
MD5 32f60ec30f6f712c6397dc07b68cce9b
SHA1 576fa07e3b08c5e66a3e773514d68a2036dd7e8c
SHA512 2d701fd7060a40d636c02a735dded542f0195c8532b46eda2d97302ba095bbf211eaaef0bde0b7b52b0d485be9e0a9e15d3d89afa481e2332fb61d76c1b800e2
SSDEEP 192:sxZHRA96/fMsOWpVPPS6cIdpJHW6+WNGY9IWwGJkIgFJ:sxZHg6/fMsOWvPK2JHbGUIv
TLSH
T1C522A6166E28A57B8CCAD21DBB657F13D6F91032A1D51E58AAFCC60C05EBADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dd8906dd0da7beab982712c7efa255de4086ef839d8ec20c25d617833e216183
MD5 73cd82d4f14044a16d4dbc6387efd5d4
SHA1 d1aba4f90a03bffe3b98f69aba6882138f6fb648
SHA512 f8c379452673f207c79f0eb5b0cbcbe1f3d032b5bfa18428fa895b3b02b0a63b1900df703b17505b850a093a4cc7a6aff95f44696126dfa7af6af844e5703741
SSDEEP 768:xLyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7erocbq1:xLyvIZwWvu+Q+u1jamFLeR71cc
TLSH
T1E6C2FA2B244CCB7E5F801A9DDD1A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 3b61a0cece460c572edc791cf429c8b4c1f7545db3b0611924b7c6db7b874f05
MD5 a78525bc90fcc2ca47d19a26f9515cd4
SHA1 587ab3385c813600877a15ce7537a72ea242d47b
SHA512 c37b2059372c12b00287acff3515f5ace744d8e532e68f98a2c89f0260b8bd4c5cfba01e6adfbbe9f89db2ab323c7a0c1ec73a249fbbc8a9323a05d4e3ecbcf7
TLSH
T109213080A2F91095AE89B941D1B96403E0E17AFD335DD836632D50F40F488260BBEA71
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b53d7c73aa3ec7ed4810e3f7df98cb3d3e810b843958363b7959cf9bff7fba35
MD5 e334d86facb3a85f7439ecd371a0bf8c
SHA1 0cdd0c3b5b08197dd2a02ed659e64c6c4116ebfa
SHA512 437328fdbbb849dd6ae1473ab2078ec597ab66f505ee130ea6f37765827387e8b3bc6c308cc4fd6d4996ce116228b8ec8018642fb357e2ee825760d0b2f8c251
SSDEEP 384:6ZcILsNPyRlc4uzijZ9Ee+CxO9+RciwOObjI9G6w7U:4Lvlc4uCP5OoRciw29MU
TLSH
T17B929D32AD380D775AA6E615F48A36135EF8A17BE2D52F80D0DCAF0C05EFAAC1305812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2d2004066ac38103bd06b6a480f02ee42ae10b184f59b77b69a95f92280ca1c7
MD5 fb0845bf30903d2df9336e44085fb77b
SHA1 1b1f703a237262750b28c323fab15f46116dec56
SHA512 afef2d1f789f77e0421fc5fe802dea2e06a19f5263c032dbe9f5193b7a9198d80f911f7a61a659285d0f6e3aa11a6beb72070b7c472463108e280478eeb04cef
SSDEEP 384:+ZcIzsNPyRlc4uzi76/Ee+CxO9+RcOGvFA8BJt7oV9jawOObjI9G6w7U:8zvlc4u3P5OoRcx68+V9j929MU
TLSH
T1EDB27B71E8781CF755A6E9C5B086F6172EF8517BD2991A4CD1F8BB3D309FAB80321811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1168237b3f41cdb11941136ffc5e8d168baec69c23bbc94e373c5a3a1de7159d
MD5 5f4c32f28a10a9aa85c4e8fd8718a3f7
SHA1 79d2a2bfdc42982a33f82386361cac5ddff56b65
SHA512 184cc3a361ae8a6c1ef86f9f450ae66ca720d230ba95468e7a468a7aefefe8faf7d752b2c56688b8a3c8eac35f36415247412abb2b597014cc69921d2816bcc5
SSDEEP 192:JONk6v+YLNQmiUyT8QZh+CGQO9UousiNLU6:JONk6vz/2DZh+CxO9PipU6
TLSH
T13D02E835AD781C7B9EE2AE05F88737176FA4217BE9912F90D9D82B1C01D775C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a984575871cbdcd94690ef4637246e80de034cf9455e65bb51b8567b1bb9271a
MD5 0e525e33149f9dc156d6bdd15277be86
SHA1 a4c517039f4131fb28ff7205f780785c5034c878
SHA512 0264ced1f1d202a6adb10db4ddef7e4be63d9ed0b5352d7da57d3f82cc6c69d26d59c89900b980f8faf2759e3e3ef4e1c81ef26a74bd30de37eb36950e9d8048
SSDEEP 192:IONS6v+YLhQmiUyTyQEh+CGQO9UNRNCHiCqwU6:IONS6vzb21Eh+CxO9+R6iwU6
TLSH
T1DA122B36B9785C7B5ED2A945F48732135EA85167EA853F80D5DC3F1C01DF7AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 82ad4cc38104589057d8471d2389ea0beb013f7685c6e2b86797cd12fa718dfc
MD5 19d400225ec200a6420bb1bd0e90b468
SHA1 955f7991566e09adb13e503483885322816f906f
SHA512 a87607cc0d4221f5b3a401e9fe81e9e66a3808a1b5ebce29f1db4713ec86cd7d0d9ca7efa9822d94f1cd21d5ff437b031a5ad9bea4a235aec90276ed64470fa0
TLSH
T105413B48AAF91154B3B77E56ABFAA86D487E78372E07D45E10110D4E0A76B40CCB1B73
MD5 SHA1 SHA512 TLSH

Submit Download

SMCSettings.json

Path C:\Users\Admin\Downloads\SMCSettings.json
Size 24KB
SHA256 3925d24185c527cec8d32fc8c320a1fe18aa54f126cabc087aa1e2fef6e58105
MD5 ade48925e10b7d3d26052f91452998be
SHA1 693cfee83e6ef51f49e567338edd582e401b3b2a
SHA512 9ae221a226a9215ef262695465c804561c709ddd9525d1f8d5847db3b0b3ffd11649198dd0df42e9c685b3b182563d6b49e8cdac0c75eb4ff355bd7c94c5aa7d
SSDEEP 192:WE+x2uD5wssZtOw3znVEK4g48jmHCHHqsnEX4w48DGH3HHjDgCfONphJ8O4Pt3ur:xznVEp3ynk
TLSH
T159B2D237D2054D6D21BDDA3DD8398D12D680834F28896D87B6BCEDCD4FF32225A8E649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMCSettings.json

Path C:\Users\Admin\Downloads\SMCSettings.json
Size 24KB
SHA256 960ca705b71620f2fac8966bc3ef88e294ca6ffe8e2d891cd71aca3a0ee22a93
MD5 760ef2ae1c66b1dec02efa30ddb2fda2
SHA1 95d52c38ed58a786b82423692be0f674dfdeac72
SHA512 44990e524d20837a03ccd9ea46412e93b9372e8dea36965a648997b5fae95b9035d21953c9e83b60cdf09eb23527e4699e5934784021fbba8627c72ffa066f7f
SSDEEP 192:WE+x2uD5wssZtOw3znVEBE+x2uD5wssZtOw3znVEK4g48jmHCHHqsnEX4w48DGHO:xznVEQznVEp3yni
TLSH
T1D4B28937D6544CBE20BDD63DC8399902E780835B29491D47B2BCADCD4FB33236A8A54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMCSettings.json

Path C:\Users\Admin\Downloads\SMCSettings.json
Size 24KB
SHA256 b773f71079700f75e021c9e87cd84d0796a24a0d48ba18869182ccd801706821
MD5 cb81c1b47abb3f0d00bbad3ad0fa4064
SHA1 aee74947dd4952abc16568a868cd4a10a4930f1b
SHA512 9d68f04e8e4601eb860001c2eb225d1e55322f7bc245b87f4ca950e6a5b31911fcddca609b34b85139d58898ea52c4dfa63729a83998c1a63a646a32f9f52454
SSDEEP 192:WE+x2uD5wssZtOw3znVEBE+x2uD5wssZtOw3znVEK4g48jmHCHHGsnEX4w48DGHW:xznVEQznVEp3cn6
TLSH
T172B28937D6544CBE20BDC63DD8399903E780835B29491D47B2BCADCD4FB33236A8A54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suspend-3.2.1.exe.crdownload

Path C:\Users\Admin\Downloads\suspend-3.2.1.exe.crdownload
Size 1.8MB
SHA256 14ac0a5d6368ef22334696e7f1479442db29c9ee81498d291e8728ad9340a55b
MD5 82b7bed3173a249d84355790a10c6013
SHA1 205efbe2440e05217dad4e64bfb65f0a98f1fddb
SHA512 b0a57281ee7af6c8fc9a8c415682f5a83aa89bfca117d9ee4630dd7d6b8875493f14ee1b3f27769a09eda09bef67d3ce9207c33d8436666f2861c016d6ed33b8
SSDEEP 24576:0D6a2XT+cXjEDrK5aQOQXJmA3hvQfJUjTGlEUHiVn7Rk6vfXUIxn0906OtNzjtMH:0oX1k8aEJmzEVn7RkQG903zjta
TLSH
T13F95AE57B2D401F8D0B6E234D946A907E772B8440F7096DF1BE04A9A2FF37E05A7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download