hxxps://discordsgift[.]com/gift/eX5PFweHPrNWCj8t

Analysis

max time kernel
154s
max time network
153s
platform
windows11_x64
resource
win11
submitted
10-10-2021 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://discordsgift.com/gift/eX5PFweHPrNWCj8t
Sample

211010-kz5slafgdj

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "30916114"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "359518044"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

sihclient.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{B7CD2189-48B7-469F-8B09-5D07756DBBF4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1512	msedge.exe
1512	msedge.exe
3668	msedge.exe
3668	msedge.exe
3900	identity_helper.exe
3900	identity_helper.exe
1644	msedge.exe
1644	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3668 msedge.exe
3668 msedge.exe
3668 msedge.exe
3668 msedge.exe
3668 msedge.exe
3668 msedge.exe

pid	process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

svchost.exesvchost.exe

description	pid	process
Token: SeSystemtimePrivilege	3560	svchost.exe
Token: SeSystemtimePrivilege	3560	svchost.exe
Token: SeIncBasePriorityPrivilege	3560	svchost.exe
Token: SeTcbPrivilege	3984	svchost.exe
Token: SeTcbPrivilege	3984	svchost.exe
Token: SeTcbPrivilege	3984	svchost.exe
Token: SeTcbPrivilege	3984	svchost.exe
Token: SeTcbPrivilege	3984	svchost.exe
Token: SeTcbPrivilege	3984	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msedge.exe

pid process

3668 msedge.exe

pid	process
3668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exemsedge.exe

description	pid	process	target process
PID 3900 wrote to memory of 3668	3900	iexplore.exe	msedge.exe
PID 3900 wrote to memory of 3668	3900	iexplore.exe	msedge.exe
PID 3668 wrote to memory of 1116	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1116	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1100	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1512	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 1512	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe
PID 3668 wrote to memory of 2744	3668	msedge.exe	msedge.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://discordsgift.com/gift/eX5PFweHPrNWCj8t
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://discordsgift.com/gift/eX5PFweHPrNWCj8t"
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcbc8a46f8,0x7ffcbc8a4708,0x7ffcbc8a4718
3⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
3⤵
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
3⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
3⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:1
3⤵
PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
3⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
3⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
3⤵
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
3⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
3⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3896 /prefetch:8
3⤵
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3964 /prefetch:8
3⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
3⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
3⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
3⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3496 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1548 /prefetch:8
3⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,9976793089794160668,8682879309703654382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5476 /prefetch:8
3⤵
PID:3384

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv Batbr0OzC06wDXaT6Bj2lw.0
1⤵
PID:4600

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv lX+JvkxKV0GZd+6TsanO5Q.0.2
1⤵
- Modifies data under HKEY_USERS
PID:5000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\edge_BITS_3668_1108571951\eb6a4dbd-98fc-4ba6-b4eb-40926ec21066
MD5
4432feb0fd3ea5ceed672376802240dd

SHA1
dfe16c564211e6f4513c65dd3201b3b26a73d8ad

SHA256
960fae5df394ff065f95f2d0a5ab95a9bf88a270103c8ed2080959eedf3836fc

SHA512
6d4c718e027c81ec540b3f1d3f1d8d7ba74284ba6ad9dee13f68e9c6dd42e1c124ea471aa2d5583e35629f64766b60cfa6548209c78417b912c23d942f2c71d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_3668_1249652923\b22f5f18-f7ea-4290-929d-b13c03908334
MD5
a36d70bcd9333175811c53122f7d2c1d

SHA1
9a9a0c0ac2fc1db6e7b78868c8d4c96d747b8f1c

SHA256
26123bef7d73536450862d2c4d44963d720aa80b6fc2d8496f559cb9c1fdeb00

SHA512
e69aee2d91c50dd63030bd64cd12b5120c1db9871caf3c26b2cbf29ff96891b5f2e7d1388e4b731f77d7fb24904f379a6a8d5c1b2aacf8a8501fd0111ab0caf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_3668_1388550278\1d147c3b-6a51-425f-a960-c0159921df27
MD5
22351f8e29208582a8c4a3be256433d7

SHA1
f05a56b94cfaf46b1c74f815cc9b9d80784ffb7e

SHA256
9ab1dc1c2c03aa5b274e583dc42891bc07dcceea577ac348940e112b48fa6006

SHA512
e13bf84d66b5f067508f5a8fb92cbea9bde8ffa3cca9a72ef1baf30d4675807de90fb2b461ea8f5ede9e13003c9fa5f3f56213aa09e4d8a2294f1f08c110a731

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_3668_797276048\94572367-7d87-41e1-bb79-e8c97147231a
MD5
407544969500d8939f1d1657db5be5e1

SHA1
823f80a02da568672f57fcaf7f1cd563b731192e

SHA256
02be1bf447628cdc96ae2b6811bc38ac47cbb5059abd6f31e9b2933f969a46af

SHA512
99d44a29cc47f7f0eecba729484f58c03cf1adc8308e0be6605f67d4aac7fc490d4f91e943c214d50fd61d677666b05e51c645432c96482fc2d55a51e66b3c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_BITS_3668_998265630\066a0908-c95c-4a25-85a2-8ad34b009ca3
MD5
7a007f77bad40a7b235345d573f75971

SHA1
1a331305a9b9b212ac3771993df6c2f831d02712

SHA256
38059acf4056b2f024fdb30fb4db82a6f99d13c7cc8e08beadffae52ee7c9650

SHA512
8f96313dfa307696961726a2830dfc71c4a0937437c2899a32a8de888c7e3c06c76fd1ff73f199d160ab19f8976ce56750eecaf02f2d105c67d6920574c8722d

Download Submit
\??\pipe\LOCAL\crashpad_3668_FIJCTCOHTFSLBFDH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1100-209-0x00000249ADDE0000-0x00000249ADDE2000-memory.dmp

Filesize
8KB

Download
memory/1100-202-0x00000249ADD2F000-0x00000249ADD30000-memory.dmp

Filesize
4KB

Download
memory/1100-211-0x00000249ADDE0000-0x00000249ADDE2000-memory.dmp

Filesize
8KB

Download
memory/1100-206-0x00000249ADDE0000-0x00000249ADDE2000-memory.dmp

Filesize
8KB

Download
memory/1100-212-0x00000249ADDE0000-0x00000249ADDE2000-memory.dmp

Filesize
8KB

Download
memory/1100-213-0x00000249ADDE0000-0x00000249ADDE2000-memory.dmp

Filesize
8KB

Download
memory/1100-205-0x00007FFCDF600000-0x00007FFCDF601000-memory.dmp

Filesize
4KB

Download
memory/1100-203-0x0000000000000000-mapping.dmp

Download
memory/1116-201-0x000001E226340000-0x000001E226342000-memory.dmp

Filesize
8KB

Download
memory/1116-200-0x000001E226340000-0x000001E226342000-memory.dmp

Filesize
8KB

Download
memory/1116-199-0x0000000000000000-mapping.dmp

Download
memory/1284-220-0x0000000000000000-mapping.dmp

Download
memory/1364-265-0x0000000000000000-mapping.dmp

Download
memory/1512-208-0x0000026E96220000-0x0000026E96222000-memory.dmp

Filesize
8KB

Download
memory/1512-207-0x0000026E96220000-0x0000026E96222000-memory.dmp

Filesize
8KB

Download
memory/1512-204-0x0000000000000000-mapping.dmp

Download
memory/1644-266-0x0000000000000000-mapping.dmp

Download
memory/1932-224-0x0000000000000000-mapping.dmp

Download
memory/2136-300-0x0000000000000000-mapping.dmp

Download
memory/2192-282-0x0000000000000000-mapping.dmp

Download
memory/2744-215-0x0000000000000000-mapping.dmp

Download
memory/3272-232-0x0000000000000000-mapping.dmp

Download
memory/3384-308-0x0000000000000000-mapping.dmp

Download
memory/3408-258-0x0000000000000000-mapping.dmp

Download
memory/3668-195-0x0000000000000000-mapping.dmp

Download
memory/3668-197-0x0000011E210D0000-0x0000011E210D2000-memory.dmp

Filesize
8KB

Download
memory/3668-196-0x0000011E210D0000-0x0000011E210D2000-memory.dmp

Filesize
8KB

Download
memory/3708-276-0x0000000000000000-mapping.dmp

Download
memory/3900-164-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-156-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-192-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-193-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-194-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-190-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-188-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-198-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-187-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-186-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-185-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-183-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-147-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-148-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-181-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-179-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-176-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-174-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-173-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-172-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-167-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-146-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-166-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-165-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-163-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-162-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-160-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-159-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-150-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-149-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-254-0x0000000000000000-mapping.dmp

Download
memory/3900-158-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-157-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-154-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-152-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-155-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-153-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3900-151-0x00007FFCCC380000-0x00007FFCCC3E5000-memory.dmp

Filesize
404KB

Download
memory/3948-288-0x0000000000000000-mapping.dmp

Download
memory/3992-244-0x0000000000000000-mapping.dmp

Download
memory/4224-241-0x0000000000000000-mapping.dmp

Download
memory/4796-189-0x0000025F031E0000-0x0000025F031E4000-memory.dmp

Filesize
16KB

Download
memory/4796-182-0x0000025F02E60000-0x0000025F02E70000-memory.dmp

Filesize
64KB

Download
memory/4796-180-0x0000025F02580000-0x0000025F02590000-memory.dmp

Filesize
64KB

Download
memory/4856-292-0x0000000000000000-mapping.dmp

Download