Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows11_x64 -
resource
win11 -
submitted
10-11-2021 17:53
Behavioral task
behavioral1
Sample
Malware Scores Based on Image Processing.pdf
Resource
win11
General
-
Target
Malware Scores Based on Image Processing.pdf
-
Size
3.3MB
-
MD5
72ff6afcf87c01199b158a4601891607
-
SHA1
73e664b0d260d3709c798669a6ebf4d2317ae40f
-
SHA256
0c3e925140ee7b2ef511dc79f82432f141eb271c17ad7dc1cf1fddae0b1297ea
-
SHA512
3b2f0b80f08b76e3ac57b769206cde1fe4938457a721b3532b54dd9a7882b94ad6deeeed8264bc664fb7df84892d225f8aa1149e2887e0bac6c69bc0f811eb9b
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
WaaSMedicAgent.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1092 msedge.exe 1092 msedge.exe 2916 msedge.exe 2916 msedge.exe 3068 identity_helper.exe 3068 identity_helper.exe 816 msedge.exe 816 msedge.exe 816 msedge.exe 816 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe 2916 msedge.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
svchost.exesvchost.exesvchost.exeWaaSMedicAgent.exedescription pid process Token: SeShutdownPrivilege 2028 svchost.exe Token: SeCreatePagefilePrivilege 2028 svchost.exe Token: SeShutdownPrivilege 2028 svchost.exe Token: SeCreatePagefilePrivilege 2028 svchost.exe Token: SeShutdownPrivilege 2028 svchost.exe Token: SeCreatePagefilePrivilege 2028 svchost.exe Token: SeShutdownPrivilege 4652 svchost.exe Token: SeCreatePagefilePrivilege 4652 svchost.exe Token: SeTcbPrivilege 1964 svchost.exe Token: SeTcbPrivilege 1964 svchost.exe Token: SeTcbPrivilege 1964 svchost.exe Token: SeTcbPrivilege 1964 svchost.exe Token: SeTcbPrivilege 1964 svchost.exe Token: SeTcbPrivilege 1964 svchost.exe Token: SeTakeOwnershipPrivilege 2632 WaaSMedicAgent.exe Token: SeSecurityPrivilege 2632 WaaSMedicAgent.exe Token: SeRestorePrivilege 2632 WaaSMedicAgent.exe Token: SeBackupPrivilege 2632 WaaSMedicAgent.exe Token: SeShutdownPrivilege 2028 svchost.exe Token: SeCreatePagefilePrivilege 2028 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
msedge.exepid process 2916 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exemsedge.exedescription pid process target process PID 1588 wrote to memory of 2916 1588 cmd.exe msedge.exe PID 1588 wrote to memory of 2916 1588 cmd.exe msedge.exe PID 2916 wrote to memory of 1008 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1008 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 920 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1092 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1092 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe PID 2916 wrote to memory of 1932 2916 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Malware Scores Based on Image Processing.pdf"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Malware Scores Based on Image Processing.pdf2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0xa0,0xe4,0x108,0xbc,0x10c,0x7fffd7b046f8,0x7fffd7b04708,0x7fffd7b047183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5052 /prefetch:63⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6224 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4756 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5848 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,9239266189200955343,4908173245253258779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 /prefetch:83⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0f5e9b4f812dd21c8dbf21e884cd1153 gLYJak+U6UqZ48PlA8vzAA.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 0f5e9b4f812dd21c8dbf21e884cd1153 gLYJak+U6UqZ48PlA8vzAA.0.1.0.3.01⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\LOCAL\crashpad_2916_FTTLOERWSNTMQYFHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/584-222-0x0000022C57B50000-0x0000022C57B52000-memory.dmpFilesize
8KB
-
memory/584-217-0x0000000000000000-mapping.dmp
-
memory/584-219-0x0000022C57B50000-0x0000022C57B52000-memory.dmpFilesize
8KB
-
memory/584-220-0x0000022C57B50000-0x0000022C57B52000-memory.dmpFilesize
8KB
-
memory/584-221-0x0000022C57B50000-0x0000022C57B52000-memory.dmpFilesize
8KB
-
memory/816-252-0x0000000000000000-mapping.dmp
-
memory/880-197-0x000001A33A5C0000-0x000001A33A5C2000-memory.dmpFilesize
8KB
-
memory/880-198-0x000001A33A5C0000-0x000001A33A5C2000-memory.dmpFilesize
8KB
-
memory/880-195-0x0000000000000000-mapping.dmp
-
memory/920-162-0x0000020FA0ED0000-0x0000020FA0ED2000-memory.dmpFilesize
8KB
-
memory/920-163-0x0000020FA0ED0000-0x0000020FA0ED2000-memory.dmpFilesize
8KB
-
memory/920-158-0x0000020FA0ED0000-0x0000020FA0ED2000-memory.dmpFilesize
8KB
-
memory/920-153-0x0000000000000000-mapping.dmp
-
memory/920-155-0x00007FFFF89D0000-0x00007FFFF89D1000-memory.dmpFilesize
4KB
-
memory/920-161-0x0000020FA0ED0000-0x0000020FA0ED2000-memory.dmpFilesize
8KB
-
memory/920-159-0x0000020FA0ED0000-0x0000020FA0ED2000-memory.dmpFilesize
8KB
-
memory/920-152-0x0000020FA0B4E000-0x0000020FA0B4F000-memory.dmpFilesize
4KB
-
memory/1008-149-0x0000000000000000-mapping.dmp
-
memory/1008-150-0x0000017860FF0000-0x0000017860FF2000-memory.dmpFilesize
8KB
-
memory/1008-151-0x0000017860FF0000-0x0000017860FF2000-memory.dmpFilesize
8KB
-
memory/1092-156-0x000002D1BC7A0000-0x000002D1BC7A2000-memory.dmpFilesize
8KB
-
memory/1092-154-0x0000000000000000-mapping.dmp
-
memory/1092-157-0x000002D1BC7A0000-0x000002D1BC7A2000-memory.dmpFilesize
8KB
-
memory/1396-215-0x0000013ED6960000-0x0000013ED6962000-memory.dmpFilesize
8KB
-
memory/1396-214-0x0000013ED6960000-0x0000013ED6962000-memory.dmpFilesize
8KB
-
memory/1396-211-0x0000013ED6960000-0x0000013ED6962000-memory.dmpFilesize
8KB
-
memory/1396-210-0x0000013ED6960000-0x0000013ED6962000-memory.dmpFilesize
8KB
-
memory/1396-206-0x0000000000000000-mapping.dmp
-
memory/1932-168-0x000001704D580000-0x000001704D582000-memory.dmpFilesize
8KB
-
memory/1932-167-0x000001704D580000-0x000001704D582000-memory.dmpFilesize
8KB
-
memory/1932-164-0x000001704D3E4000-0x000001704D3E5000-memory.dmpFilesize
4KB
-
memory/1932-165-0x0000000000000000-mapping.dmp
-
memory/1992-207-0x0000018A1D390000-0x0000018A1D392000-memory.dmpFilesize
8KB
-
memory/1992-213-0x0000018A1D390000-0x0000018A1D392000-memory.dmpFilesize
8KB
-
memory/1992-212-0x0000018A1D390000-0x0000018A1D392000-memory.dmpFilesize
8KB
-
memory/1992-208-0x0000018A1D390000-0x0000018A1D392000-memory.dmpFilesize
8KB
-
memory/1992-203-0x0000000000000000-mapping.dmp
-
memory/2028-170-0x000001B542C20000-0x000001B542C30000-memory.dmpFilesize
64KB
-
memory/2028-169-0x000001B542520000-0x000001B542530000-memory.dmpFilesize
64KB
-
memory/2028-171-0x000001B545300000-0x000001B545304000-memory.dmpFilesize
16KB
-
memory/2208-248-0x0000000000000000-mapping.dmp
-
memory/2596-238-0x0000000000000000-mapping.dmp
-
memory/2896-191-0x0000027039370000-0x0000027039372000-memory.dmpFilesize
8KB
-
memory/2896-186-0x0000000000000000-mapping.dmp
-
memory/2896-189-0x0000027039370000-0x0000027039372000-memory.dmpFilesize
8KB
-
memory/2896-188-0x0000027039370000-0x0000027039372000-memory.dmpFilesize
8KB
-
memory/2896-190-0x0000027039370000-0x0000027039372000-memory.dmpFilesize
8KB
-
memory/2916-148-0x0000023E09DD0000-0x0000023E09DD2000-memory.dmpFilesize
8KB
-
memory/2916-146-0x0000000000000000-mapping.dmp
-
memory/2916-147-0x0000023E09DD0000-0x0000023E09DD2000-memory.dmpFilesize
8KB
-
memory/3044-259-0x0000000000000000-mapping.dmp
-
memory/3068-201-0x0000025743490000-0x0000025743492000-memory.dmpFilesize
8KB
-
memory/3068-200-0x0000025743490000-0x0000025743492000-memory.dmpFilesize
8KB
-
memory/3068-199-0x0000000000000000-mapping.dmp
-
memory/3380-231-0x0000000000000000-mapping.dmp
-
memory/3844-243-0x0000000000000000-mapping.dmp
-
memory/4084-182-0x0000025641CF0000-0x0000025641CF2000-memory.dmpFilesize
8KB
-
memory/4084-172-0x0000025641954000-0x0000025641955000-memory.dmpFilesize
4KB
-
memory/4084-173-0x0000000000000000-mapping.dmp
-
memory/4084-177-0x0000025641CF0000-0x0000025641CF2000-memory.dmpFilesize
8KB
-
memory/4084-192-0x0000025641CF0000-0x0000025641CF2000-memory.dmpFilesize
8KB
-
memory/4084-178-0x0000025641CF0000-0x0000025641CF2000-memory.dmpFilesize
8KB
-
memory/4208-183-0x0000021630940000-0x0000021630942000-memory.dmpFilesize
8KB
-
memory/4208-180-0x0000021630940000-0x0000021630942000-memory.dmpFilesize
8KB
-
memory/4208-181-0x0000021630940000-0x0000021630942000-memory.dmpFilesize
8KB
-
memory/4208-176-0x0000000000000000-mapping.dmp
-
memory/4208-174-0x00000216307AB000-0x00000216307AC000-memory.dmpFilesize
4KB
-
memory/4208-184-0x0000021630940000-0x0000021630942000-memory.dmpFilesize
8KB
-
memory/4744-193-0x0000000000000000-mapping.dmp
-
memory/5024-224-0x0000000000000000-mapping.dmp