Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Analysis

  • max time kernel
    1575s
  • max time network
    1800s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    02-04-2021 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DBF.Viewer.Pro.3.11.crack.by.F4CG.exe

  • Size

    4.8MB

  • MD5

    98e0552e7c661d3f84c5ca691bb58b60

  • SHA1

    f8747cbd9256e9587e45b1feeded6b082b098e5d

  • SHA256

    23e30d6f1d505e6a0cf1672ec7420d28af81975a9832f1af2eae8a3233a09eb4

  • SHA512

    d767b09e6d24ce96ce95e7cbcb248b93373f7dcbad3a96ba249a3c54df9511567c4ff2bfd8393492a0f90ae8bf5ab37c1cf71f75092ad81dde7a7a7a5f7e76da

Score
10/10
azorultxmrigdiscoveryevasioninfostealerminerpersistencespywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 30 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 7 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DBF.Viewer.Pro.3.11.crack.by.F4CG.exe
    "C:\Users\Admin\AppData\Local\Temp\DBF.Viewer.Pro.3.11.crack.by.F4CG.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3892
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4068
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1460
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:2212
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:4044
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2056
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2292
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:2456
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Users\Admin\AppData\Local\Temp\FRNAARQMSF\setups.exe
              "C:\Users\Admin\AppData\Local\Temp\FRNAARQMSF\setups.exe" ll
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4640
              • C:\Users\Admin\AppData\Local\Temp\is-LLIL5.tmp\setups.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-LLIL5.tmp\setups.tmp" /SL5="$701D0,635399,250368,C:\Users\Admin\AppData\Local\Temp\FRNAARQMSF\setups.exe" ll
                6⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:188
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
            4⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4256
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im chrome.exe
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3916
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im chrome.exe
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1080
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1240
            • C:\Users\Admin\AppData\Roaming\7758.tmp.exe
              "C:\Users\Admin\AppData\Roaming\7758.tmp.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4440
              • C:\Users\Admin\AppData\Roaming\7758.tmp.exe
                "C:\Users\Admin\AppData\Roaming\7758.tmp.exe"
                6⤵
                • Executes dropped EXE
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:4652
            • C:\Users\Admin\AppData\Roaming\77E6.tmp.exe
              "C:\Users\Admin\AppData\Roaming\77E6.tmp.exe"
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              PID:1908
              • C:\Windows\system32\msiexec.exe
                -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                6⤵
                  PID:4676
                • C:\Windows\system32\msiexec.exe
                  -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
                  6⤵
                  • Blocklisted process makes network request
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5000
              • C:\Users\Admin\AppData\Roaming\7893.tmp.exe
                "C:\Users\Admin\AppData\Roaming\7893.tmp.exe"
                5⤵
                • Executes dropped EXE
                PID:2264
                • C:\Windows\SysWOW64\cmd.exe
                  /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\7893.tmp.exe
                  6⤵
                    PID:1940
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 3
                      7⤵
                      • Delays execution with timeout.exe
                      PID:4408
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                  5⤵
                    PID:2452
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1
                      6⤵
                      • Runs ping.exe
                      PID:4028
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                  4⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2432
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5116
                  • C:\ProgramData\8441342.exe
                    "C:\ProgramData\8441342.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4744
                  • C:\ProgramData\5684678.exe
                    "C:\ProgramData\5684678.exe"
                    5⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    PID:4740
                    • C:\ProgramData\Windows Host\Windows Host.exe
                      "C:\ProgramData\Windows Host\Windows Host.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:372
                  • C:\ProgramData\8568804.exe
                    "C:\ProgramData\8568804.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3640
                    • C:\ProgramData\8568804.exe
                      "{path}"
                      6⤵
                      • Executes dropped EXE
                      PID:2668
                    • C:\ProgramData\8568804.exe
                      "{path}"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4796
                  • C:\ProgramData\2928718.exe
                    "C:\ProgramData\2928718.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3860
                    • C:\ProgramData\2928718.exe
                      "{path}"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4716
                  • C:\ProgramData\5342057.exe
                    "C:\ProgramData\5342057.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3144
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:4024
                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                    5⤵
                    • Executes dropped EXE
                    PID:216
                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4620
                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1800
                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:96
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
            1⤵
            • Drops file in Windows directory
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3400
          • C:\Windows\system32\browser_broker.exe
            C:\Windows\system32\browser_broker.exe -Embedding
            1⤵
            • Modifies Internet Explorer settings
            PID:4200
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            PID:4468
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:1212
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:3140
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
            • Modifies registry class
            PID:3484
          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
            1⤵
              PID:4804
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
              1⤵
              • Modifies registry class
              PID:4108
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
              1⤵
              • Modifies registry class
              PID:4624
            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
              1⤵
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3452
            • C:\Windows\system32\browser_broker.exe
              C:\Windows\system32\browser_broker.exe -Embedding
              1⤵
                PID:4752
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:1224
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies registry class
                PID:1648
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                1⤵
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4728
              • C:\Windows\system32\browser_broker.exe
                C:\Windows\system32\browser_broker.exe -Embedding
                1⤵
                • Modifies Internet Explorer settings
                PID:3772
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:4176
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies registry class
                PID:4320
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                  PID:1096
                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                  1⤵
                  • Modifies registry class
                  PID:1432
                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                  1⤵
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:332
                • C:\Windows\system32\AUDIODG.EXE
                  C:\Windows\system32\AUDIODG.EXE 0xf8
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2764

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/188-51-0x00000000021E1000-0x00000000021E8000-memory.dmp

                  Filesize

                  28KB

                  Download

                • memory/188-52-0x00000000001E0000-0x00000000001E1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/188-48-0x00000000032F1000-0x000000000331C000-memory.dmp

                  Filesize

                  172KB

                  Download

                • memory/188-44-0x00000000007D1000-0x00000000007D3000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/372-177-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/372-187-0x0000000005410000-0x0000000005411000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1240-74-0x0000000000400000-0x0000000000448000-memory.dmp

                  Filesize

                  288KB

                  Download

                • memory/1240-58-0x0000000000B20000-0x0000000000B2D000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/1460-26-0x0000000002900000-0x0000000002A9C000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/1768-27-0x0000000000470000-0x0000000000471000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1768-31-0x000000001BB60000-0x000000001BB62000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/1768-25-0x00007FFEE8270000-0x00007FFEE8C5C000-memory.dmp

                  Filesize

                  9.9MB

                  Download

                • memory/2264-97-0x0000000000400000-0x000000000587C000-memory.dmp

                  Filesize

                  84.5MB

                  Download

                • memory/2264-96-0x0000000007530000-0x000000000C9AC000-memory.dmp

                  Filesize

                  84.5MB

                  Download

                • memory/3144-186-0x00000000053C0000-0x00000000053C1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3144-158-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3144-172-0x0000000002B50000-0x0000000002B8B000-memory.dmp

                  Filesize

                  236KB

                  Download

                • memory/3144-165-0x0000000001260000-0x0000000001261000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3144-178-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3144-153-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/3640-169-0x0000000007480000-0x0000000007481000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3640-199-0x0000000009270000-0x0000000009316000-memory.dmp

                  Filesize

                  664KB

                  Download

                • memory/3640-200-0x000000000B910000-0x000000000B971000-memory.dmp

                  Filesize

                  388KB

                  Download

                • memory/3640-166-0x0000000008DD0000-0x0000000008E65000-memory.dmp

                  Filesize

                  596KB

                  Download

                • memory/3640-140-0x00000000058B0000-0x00000000058B1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3640-137-0x0000000005EE0000-0x0000000005EE1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3640-133-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3640-168-0x0000000005B50000-0x0000000005B55000-memory.dmp

                  Filesize

                  20KB

                  Download

                • memory/3640-131-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/3640-159-0x0000000001770000-0x0000000001771000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3640-150-0x00000000058A0000-0x00000000058A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3860-173-0x0000000004D50000-0x0000000004D51000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3860-175-0x0000000000B80000-0x0000000000B81000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3860-208-0x0000000000B20000-0x0000000000B7E000-memory.dmp

                  Filesize

                  376KB

                  Download

                • memory/3860-155-0x00000000000C0000-0x00000000000C1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3860-207-0x0000000009060000-0x0000000009104000-memory.dmp

                  Filesize

                  656KB

                  Download

                • memory/3860-146-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/4440-86-0x00000000047F0000-0x0000000004837000-memory.dmp

                  Filesize

                  284KB

                  Download

                • memory/4440-76-0x0000000004930000-0x0000000004931000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4640-35-0x0000000000401000-0x000000000040C000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4652-79-0x0000000000400000-0x000000000044E000-memory.dmp

                  Filesize

                  312KB

                  Download

                • memory/4652-87-0x0000000000400000-0x000000000044E000-memory.dmp

                  Filesize

                  312KB

                  Download

                • memory/4676-84-0x0000000140000000-0x0000000140383000-memory.dmp

                  Filesize

                  3.5MB

                  Download

                • memory/4676-91-0x0000000140000000-0x0000000140383000-memory.dmp

                  Filesize

                  3.5MB

                  Download

                • memory/4716-210-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                  Download

                • memory/4716-212-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/4716-216-0x00000000055F0000-0x00000000055F1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4740-125-0x0000000000050000-0x0000000000051000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4740-123-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/4740-132-0x0000000000990000-0x0000000000991000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4740-154-0x00000000008D0000-0x00000000008D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4740-139-0x0000000002330000-0x0000000002344000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4740-136-0x00000000049E0000-0x00000000049E1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4744-117-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/4744-189-0x00000000057A0000-0x00000000057A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4744-134-0x0000000005700000-0x0000000005701000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4744-142-0x000000000AD10000-0x000000000AD44000-memory.dmp

                  Filesize

                  208KB

                  Download

                • memory/4744-127-0x0000000003080000-0x0000000003081000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4744-122-0x0000000000E40000-0x0000000000E41000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4744-149-0x000000000AD70000-0x000000000AD71000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-206-0x0000000005080000-0x0000000005081000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-219-0x0000000005800000-0x0000000005801000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-230-0x0000000006F70000-0x0000000006F71000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-229-0x0000000006870000-0x0000000006871000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-222-0x0000000005B00000-0x0000000005B01000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-221-0x00000000058A0000-0x00000000058A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-201-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                  Download

                • memory/4796-203-0x0000000071680000-0x0000000071D6E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/4796-220-0x0000000005860000-0x0000000005861000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-218-0x0000000005D90000-0x0000000005D91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-217-0x00000000055D0000-0x00000000055D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4796-209-0x00000000010D0000-0x00000000010D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5000-89-0x0000000140000000-0x000000014070A000-memory.dmp

                  Filesize

                  7.0MB

                  Download

                • memory/5000-198-0x000002217D200000-0x000002217D220000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5000-93-0x0000000140000000-0x000000014070A000-memory.dmp

                  Filesize

                  7.0MB

                  Download

                • memory/5000-94-0x0000000140000000-0x000000014070A000-memory.dmp

                  Filesize

                  7.0MB

                  Download

                • memory/5000-95-0x000002217BA20000-0x000002217BA40000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/5000-92-0x000002217B7E0000-0x000002217B7F4000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/5116-119-0x00000000013F0000-0x00000000013F2000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/5116-108-0x00007FFEE7070000-0x00007FFEE7A5C000-memory.dmp

                  Filesize

                  9.9MB

                  Download

                • memory/5116-109-0x0000000000D80000-0x0000000000D81000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5116-113-0x00000000013D0000-0x00000000013D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5116-111-0x00000000013A0000-0x00000000013A1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5116-112-0x00000000013B0000-0x00000000013CD000-memory.dmp

                  Filesize

                  116KB

                  Download