ceb6a0b8e1c27c75155ab28b9283fe488ae5daca15b0cc58ebfc009200c8e824

Analysis

max time kernel
142s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wave Goodbye.exe
Size

6.0MB
MD5

b67c09157b260b02037a716d28d7c34f
SHA1

a6da5549351e78fda395b5381dcf9e14240390fd
SHA256

ceb6a0b8e1c27c75155ab28b9283fe488ae5daca15b0cc58ebfc009200c8e824
SHA512

61cc65311af74f83ea950ef54661a5421df67026f7760e257ae3701b3b339f554ac1b42a63f2adafe142ad71a81c545b6749aac0a4f5c78eccd90d072fb7bbad
SSDEEP

98304:dHx3rQ9UT/cnDEuzHEAtpW1pAT0WaDMyaATQKC2witrFr9vQVN9x3gHWdFISYft4:73rpbcnDEuzkAtpWzATIaAEHVYJJmN/P

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Wave Goodbye.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Wave Goodbye.exe
Drops file in Drivers directory 1 IoCs

Processes:

Wave Goodbye.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts Wave Goodbye.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Wave Goodbye.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Wave Goodbye.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Wave Goodbye.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wave Goodbye.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wave Goodbye.exe

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1340-0-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-3-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-2-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-4-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-5-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-6-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-42-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-119-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-229-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-234-0x0000000140000000-0x0000000140F65000-memory.dmp	themida
behavioral1/memory/1340-236-0x0000000140000000-0x0000000140F65000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Wave Goodbye.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Wave Goodbye.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

33 discord.com
34 discord.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Wave Goodbye.exe

pid process

1340 Wave Goodbye.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wave Goodbye.exe

flow	ioc
33	discord.com
34	discord.com

pid	process
1340	Wave Goodbye.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{6987F2E6-4102-40DE-A3B1-6A665980DF0B}	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Wave Goodbye.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\144E3687B1ABF2C93D845118485A9E9E4407C93A	Wave Goodbye.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\144E3687B1ABF2C93D845118485A9E9E4407C93A\Blob = 030000000100000014000000144e3687b1abf2c93d845118485a9e9e4407c93a2000000001000000b9050000308205b53082039da00302010202140c1f3dced2c83786458b8b3d31fdbfb6558aa8d3300d06092a864886f70d01010b0500306a310b30090603550406130255533113301106035504080c0a43616c69666f726e696131223020060355040a0c19476f6f676c65205472757374205365727669636573204c4c433122302006035504030c19476f6f676c65205472757374205365727669636573204c4c43301e170d3234303630343132313431385a170d3239303630343132313431385a306a310b30090603550406130255533113301106035504080c0a43616c69666f726e696131223020060355040a0c19476f6f676c65205472757374205365727669636573204c4c433122302006035504030c19476f6f676c65205472757374205365727669636573204c4c4330820222300d06092a864886f70d01010105000382020f003082020a0282020100d6b1e4c30f439b224fdad6d7f0686d1d2c05e728c325f8c1da9513002a40a83424bb47b782467f3077d13bb2f3b254f573d17b7817e595888c548b02e845f8a34c2dd1b385675a87ab87e8428b3c6c0bdd16a24ea10495480af3582e55316f9c0731ef7f3c4fd15015899655f5a2a45cc9fee0a92200c073d48f1e437190720766f19bffa8d59fffadd3525f523e31a6cfdd633708c2a195b61ec910b8c302c99ac42baee759e1be9def6b01b02accef28aa13a9335e5d05e03cfb97c4c5efc7cce1d0854fb0085dd191acd9445bd193a6768131c336da2ebff5fd1508e7b93db45c54ea495f6486ef7539f614b9ba8b51877e23f3ee35c7b3cf9eac34bdbb89c2851671a19ab19111dbe647b206e0a014d7a8dc8acfb4115ad5c1b949d033d328d68e3280d6b7da552e7913f76378f18bbd2ad97ba05d42f80626515b47eac6d9613768113a31462d6ce41eef081aa359e83f0d4f4648352fda4f31d0ff8d5072152fbbaa6f51839d215c482f7e14fc7c6d52430fc1c2922ec081ce64534318e0764ede4f3f619e6cecc68b97ebb2dba85d47250181d4c649f34540ebe60ab64d3eabae9001dc3fcd15d9027f4b3babe6efcc012821ba49da004cdb4d367f77faec3ef44dad14f36ca7847381dba54468bdb3797dbdb30ce9b1f2b3ea39a7c1985f3ae3f3ee4e1d699dc60b70ab3559d360b752ffe5867efa6025fa022f825d0203010001a3533051301d0603551d0e04160414259f70a24e8b332df0f8d98bd36ce93fabc894ab301f0603551d23041830168014259f70a24e8b332df0f8d98bd36ce93fabc894ab300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038202010020e5f289742cba5c4627793a8a2f0d14d59acbf92bb4f97cbdeaf80208fc6027fecb3f1e4bca7dddfabf486f12d0098816361eccb47f037001dc7c5d16124c0025fad0ab4d35dccb3a624dbe5c0e38fe60658abad9f572ecca5df3f774d5a5eb5dbb56406ece7bbce47fa74d40ff0ba3309a9f95e791f980cec44b9da29604835db786bbdf714ab712c6287fc4940ef7f0449f3029e940fe61b290c2cea73b783fbaa21ea4a8b3f6cfdcc63b9dbd6a8731964aab6383ec01eea8fbf142778eddf538b022aaa4ac101e33a196aaa6d11aeeeaa37dd4d8f5d6bfa42c8fb58cc7adb08f38502592084a51f2d1ebd356991c837072879b1240993bf4ad01adcb998860f8c4680d6d76f2c5c68afe5de757deab7877bb287eb60fc46392a8113cd45a094b88101ec0d0c5d34dc4d3b4870567188aeb1f8df2c26fd5d12667575c71ea1bf272e424af711170b617ec3a5ce1a0db9a208b31b3b1048b61267b16d5287ee575d5b293988879775eee5d4392aa8f8eb3b39f91203a40990fd4d84c9965acd373bea5e44fa38491c08ac7c0bf6daa246b2b618b12a1756ff12ef401b7d38cdc6bfb0b5ecb7c89f113bf13c827a854492f65e4ee6c9e70fae22dcce01aec83294ba3ed620ab9ca681d6bb71bb4d397ba744d22912bca79aee83287e49593914e0001d4006acc74cdc83da2160f1deb7ac0fe5046c557771eefb82a4758929d	Wave Goodbye.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\144E3687B1ABF2C93D845118485A9E9E4407C93A	Wave Goodbye.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

4500 msedge.exe
4500 msedge.exe
5064 msedge.exe
5064 msedge.exe
3308 msedge.exe
3308 msedge.exe
2324 identity_helper.exe
2324 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

5064 msedge.exe
5064 msedge.exe
5064 msedge.exe
5064 msedge.exe
5064 msedge.exe
5064 msedge.exe
5064 msedge.exe

pid	process
4500	msedge.exe
4500	msedge.exe
5064	msedge.exe
5064	msedge.exe
3308	msedge.exe
3308	msedge.exe
2324	identity_helper.exe
2324	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Wave Goodbye.exemsedge.exe

description	pid	process	target process
PID 1340 wrote to memory of 5064	1340	Wave Goodbye.exe	msedge.exe
PID 1340 wrote to memory of 5064	1340	Wave Goodbye.exe	msedge.exe
PID 5064 wrote to memory of 1048	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1048	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 1864	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 4500	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 4500	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe
PID 5064 wrote to memory of 396	5064	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Wave Goodbye.exe
"C:\Users\Admin\AppData\Local\Temp\Wave Goodbye.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/6NNYUEXAR2
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa9fec46f8,0x7ffa9fec4708,0x7ffa9fec4718
3⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
3⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
3⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
3⤵
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
3⤵
PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
3⤵
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3468 /prefetch:8
3⤵
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3564 /prefetch:8
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
3⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
3⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
3⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
3⤵
PID:512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,5797141153788489590,15155627195156367051,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
3⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:540

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
59740101ed399e66b894e3e53616ff61

SHA1
355fe96c4675d3f8f785afb9c8be5e348e42c81a

SHA256
42b8eb96d25aeeac599e4c4c2ea4c257360389e6b7383873268886e7c75d7bc7

SHA512
83926524a40bf86456d4975f9d237c68406381641ebe4f750a4d2eb0b3e754a49d725c3c5361c6169333b0011fb203b7f17d9c0e64afbea9b2c239b30e2c2447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
323B

MD5
74c9e7193b0cb61e692095d8d9e01ae8

SHA1
2f60d0b754e400d545d5f3829ae3b0a0b990d821

SHA256
b51c6699b167d0179b11f965336dd9133829945e8992fb391043536d336d9baf

SHA512
e3abb8a66b88de18aa084934f2d481d7f10060d35b0426a12b7dc1e7a3a8199261be181e889a4054c5d108884a16eb304a7e1b575de21820bd97acb48c13d747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6a1028238b2a2e3242780e7857053c4b

SHA1
3faee218c3c19658a7c219873743937db68091af

SHA256
da48312da2a3825aaa3e7175ad20e52d93220a064aaba61c69eef3cf0ddf2be9

SHA512
60ded46382b0436cec7a3ca00d0a2660db59de48d5a776b404303cbd31ac8e8c7ee424d16172e6054ce2e87a217bd872b71cf34c1c86138b305c99a5dadfcf70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a916af16e0e18a83331bc96d958c2e51

SHA1
8ab242c1185c333f9da7f907c4c5230835b71484

SHA256
0824c2e0961fd75e2d8c2cea1e1a9449601bb2eca12c7c1df5bb2fb369cb13ad

SHA512
2e28d9e3d616c45751a2a17ce855a2fed61011c746326d6e5a3bc7411866c9659e73d8d0419465b8958771a3838202b6df16f66f7bf5741425bdfe7b49fe159b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
af6cfe4fa061cb53d3bd36c18664df19

SHA1
75900cb7bf8ad275c2d93ad3b25fe5b8b1e0c363

SHA256
1056d6202d09b363ac3bfc0df15dbba17283753cd64b06bfa45c011af54992e9

SHA512
a84a6a35890e894e810682a42782f758cb380d17047ae5faa79eb8f502655ccbdd65afa8fb4a6ad402c13d7e52f9ccd50fe6ca1b21a1c550aa3dcb24d909fb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2b074cd309669a43a3acdaa3fb142e81

SHA1
ca18a7006e8536ed1b0031c9d3028c98608dc9da

SHA256
4f3e27c5c3d058ac865d7de3a7f69bf221bc07350d20538a52c7ea96ba0f5c4f

SHA512
0659198e665515be5ec0e07fa0dfae155a44ff7aa33ae5b16c6c250072426a567055b444ec1024373c7f932f62c47ded406f319bc2ffa1fdb2c8a67d7f304beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d3346969afc63e3260f90c654ed20e7a

SHA1
4be78370c3c1f5e3af0e017b31f1afd3451d0a5a

SHA256
a9158b788fc8bae77121dd2d38c9f56f2818e49b9ae614d50cc062547a671fb6

SHA512
1961e83055f6576d262fdc942664f4dcb3904e9157aa51db7c301c161a1d94467e690e6ca6afdf356730ef6aa87f41a5da9feb6874dbfe3f52b0ff90bf95502b

Download Submit
\??\pipe\LOCAL\crashpad_5064_DYYPELINDGJIPTHP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1340-5-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-42-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-6-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-0-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-119-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-4-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-2-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-3-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-1-0x00007FFAAE570000-0x00007FFAAE572000-memory.dmp

Filesize
8KB

Download
memory/1340-229-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-234-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download
memory/1340-236-0x0000000140000000-0x0000000140F65000-memory.dmp

Filesize
15.4MB

Download