hxxps://nawa-store[.]com/shopinside

General

Target

https://nawa-store.com/shopinside
Sample

210818-n1gz5j7lfa

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3584291879"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "30905418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

sihclient.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5000	msedge.exe
5000	msedge.exe
4604	msedge.exe
4604	msedge.exe
2344	identity_helper.exe
2344	identity_helper.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeTcbPrivilege	880	svchost.exe
Token: SeTcbPrivilege	880	svchost.exe
Token: SeTcbPrivilege	880	svchost.exe
Token: SeTcbPrivilege	880	svchost.exe
Token: SeTcbPrivilege	880	svchost.exe
Token: SeTcbPrivilege	880	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msedge.exe

pid process

4604 msedge.exe

pid	process
4604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exemsedge.exe

description	pid	process	target process
PID 4568 wrote to memory of 4604	4568	iexplore.exe	msedge.exe
PID 4568 wrote to memory of 4604	4568	iexplore.exe	msedge.exe
PID 4604 wrote to memory of 3732	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 3732	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 4488	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 5000	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 5000	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe
PID 4604 wrote to memory of 432	4604	msedge.exe	msedge.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://nawa-store.com/shopinside
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://nawa-store.com/shopinside"
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa471646f8,0x7ffa47164708,0x7ffa47164718
3⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
3⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
3⤵
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
3⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
3⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
3⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
3⤵
PID:1008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
3⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
3⤵
PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3200 /prefetch:8
3⤵
PID:5480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3176 /prefetch:8
3⤵
PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1112 /prefetch:8
3⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1852 /prefetch:8
3⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,4805796944475822712,11752040392063182782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:8
3⤵
PID:1580

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv fxGCPoqzUkqRX7Y2Kt3T4A.0.2
1⤵
- Modifies data under HKEY_USERS
PID:976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:5264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\edge_BITS_4604_1575203910\b22f5f18-f7ea-4290-929d-b13c03908334
MD5
a36d70bcd9333175811c53122f7d2c1d

SHA1
9a9a0c0ac2fc1db6e7b78868c8d4c96d747b8f1c

SHA256
26123bef7d73536450862d2c4d44963d720aa80b6fc2d8496f559cb9c1fdeb00

SHA512
e69aee2d91c50dd63030bd64cd12b5120c1db9871caf3c26b2cbf29ff96891b5f2e7d1388e4b731f77d7fb24904f379a6a8d5c1b2aacf8a8501fd0111ab0caf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_4604_1617638910\73488d35-4a20-45e5-a813-40b10aec38a5
MD5
30de66cb327e7099a99792617f0d2ee2

SHA1
477a8b9bebd09a70483f605e5e946a41c7cc11c1

SHA256
2b9686f8469e6fa45d1b911dbce40dd84a569f702c6d52586503ef8aa3cbc8d1

SHA512
d408e1d6b045aecfd40738b8344a9393a2a4a0e14e83c74710605a4c319a8c7655130885adf92656f7c81c9cd82388db5d39caf1b5eb3d4c3c6926b5516d0e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_4604_235405177\1d147c3b-6a51-425f-a960-c0159921df27
MD5
22351f8e29208582a8c4a3be256433d7

SHA1
f05a56b94cfaf46b1c74f815cc9b9d80784ffb7e

SHA256
9ab1dc1c2c03aa5b274e583dc42891bc07dcceea577ac348940e112b48fa6006

SHA512
e13bf84d66b5f067508f5a8fb92cbea9bde8ffa3cca9a72ef1baf30d4675807de90fb2b461ea8f5ede9e13003c9fa5f3f56213aa09e4d8a2294f1f08c110a731

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_4604_395479943\0a5f110e-e0a3-4b12-a860-a8e62e3be71f
MD5
43456ea826951e20c9d0694a01f1886b

SHA1
9c848aa393d9ea2fd63873381e3af72b7a2e03f4

SHA256
68715ca8cdd03437049d6d9d2ceb47584b886a7807bc9b2b483e3faa174694df

SHA512
1c102ac415d393754e3ab07b5ffe6ebc60ad4888072bf194d85c57da07eef58fa7ba21ee2a6a45a287540325da1a72c9de362526fc62f122c340021d80ea0d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_4604_510341308\320fa221-fff7-48f5-b84b-2dd6068ee237
MD5
3c6861d6e575eebddfbc882af631e81e

SHA1
801ed776129028dfc70256707252682d07ab7cb1

SHA256
ac709ac32c42d190b315519bfdf8b1b7cfdd136bf13ec17f66b9a119d62e6604

SHA512
f4c74ee2a793b437d1a263ff1dac06bfb13b7bb3b1ccdf5768f3518c1fdcb39dc45df15ba9d14cb512d1cebd991648497ecb9c1041ebc428aec62c88f6773a58

Download Submit
\??\pipe\LOCAL\crashpad_4604_FZZQQCWOMFVEXVZX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/432-166-0x0000000000000000-mapping.dmp

Download
memory/1008-192-0x0000000000000000-mapping.dmp

Download
memory/1260-237-0x0000000000000000-mapping.dmp

Download
memory/1352-171-0x0000000000000000-mapping.dmp

Download
memory/1444-175-0x0000000000000000-mapping.dmp

Download
memory/1476-185-0x0000000000000000-mapping.dmp

Download
memory/1580-245-0x0000000000000000-mapping.dmp

Download
memory/1700-229-0x0000000000000000-mapping.dmp

Download
memory/2344-205-0x0000000000000000-mapping.dmp

Download
memory/3732-150-0x0000000000000000-mapping.dmp

Download
memory/4488-157-0x00007FFA68F30000-0x00007FFA68F31000-memory.dmp

Filesize
4KB

Download
memory/4488-154-0x0000000000000000-mapping.dmp

Download
memory/4544-195-0x0000000000000000-mapping.dmp

Download
memory/4568-146-0x00007FFA57D00000-0x00007FFA57D65000-memory.dmp

Filesize
404KB

Download
memory/4604-147-0x0000000000000000-mapping.dmp

Download
memory/4724-225-0x0000000000000000-mapping.dmp

Download
memory/5000-155-0x0000000000000000-mapping.dmp

Download
memory/5264-209-0x000001FB66AE0000-0x000001FB66AF0000-memory.dmp

Filesize
64KB

Download
memory/5264-241-0x000001FB69440000-0x000001FB69444000-memory.dmp

Filesize
16KB

Download
memory/5264-242-0x000001FB69440000-0x000001FB69444000-memory.dmp

Filesize
16KB

Download
memory/5264-208-0x000001FB66A60000-0x000001FB66A70000-memory.dmp

Filesize
64KB

Download
memory/5480-213-0x0000000000000000-mapping.dmp

Download
memory/5688-219-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads