Analysis
-
max time kernel
163s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 10:45
Static task
static1
Behavioral task
behavioral1
Sample
8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c.msi
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c.msi
Resource
win10v2004-en-20220113
General
-
Target
8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c.msi
-
Size
280KB
-
MD5
2e81921e3cdeddd24b74f59039bde7a0
-
SHA1
45950947f0cf45583514eebc95a361e55fd479b8
-
SHA256
8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c
-
SHA512
287fb25c2f96df4cca630deb02e64b021395cb46dddc8fe40d833b1db2bc7c25e379824942e17bf1695c036f6115c5cb518c2811e7b5c4a087fd6914b4ab0c5f
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
MsiExec.exeflow pid process 21 4860 MsiExec.exe 25 4860 MsiExec.exe -
Executes dropped EXE 1 IoCs
Processes:
lcD07C.tmppid process 3656 lcD07C.tmp -
Loads dropped DLL 4 IoCs
Processes:
MsiExec.exepid process 4860 MsiExec.exe 4860 MsiExec.exe 4860 MsiExec.exe 4860 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220213104756.pma setup.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7a1988db-6e65-480e-bdc8-921632dbeeac.tmp setup.exe -
Drops file in Windows directory 19 IoCs
Processes:
msiexec.exesvchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\Installer\MSICF93.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File created C:\Windows\Installer\1cd9a0b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\Installer\MSID040.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE8AC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSICEC7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID216.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Installer\1cd9a0b.msi msiexec.exe File created C:\Windows\Installer\SourceHash{91F82BA2-AE86-491F-B692-C1810065DB24} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msiexec.exemsedge.exemsedge.exeidentity_helper.exepid process 1424 msiexec.exe 1424 msiexec.exe 2108 msedge.exe 2108 msedge.exe 4736 msedge.exe 4736 msedge.exe 3672 identity_helper.exe 3672 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
msedge.exepid process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exesvchost.exeTiWorker.exesvchost.exedescription pid process Token: SeShutdownPrivilege 3896 msiexec.exe Token: SeIncreaseQuotaPrivilege 3896 msiexec.exe Token: SeSecurityPrivilege 1424 msiexec.exe Token: SeCreateTokenPrivilege 3896 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3896 msiexec.exe Token: SeLockMemoryPrivilege 3896 msiexec.exe Token: SeIncreaseQuotaPrivilege 3896 msiexec.exe Token: SeMachineAccountPrivilege 3896 msiexec.exe Token: SeTcbPrivilege 3896 msiexec.exe Token: SeSecurityPrivilege 3896 msiexec.exe Token: SeTakeOwnershipPrivilege 3896 msiexec.exe Token: SeLoadDriverPrivilege 3896 msiexec.exe Token: SeSystemProfilePrivilege 3896 msiexec.exe Token: SeSystemtimePrivilege 3896 msiexec.exe Token: SeProfSingleProcessPrivilege 3896 msiexec.exe Token: SeIncBasePriorityPrivilege 3896 msiexec.exe Token: SeCreatePagefilePrivilege 3896 msiexec.exe Token: SeCreatePermanentPrivilege 3896 msiexec.exe Token: SeBackupPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 3896 msiexec.exe Token: SeShutdownPrivilege 3896 msiexec.exe Token: SeDebugPrivilege 3896 msiexec.exe Token: SeAuditPrivilege 3896 msiexec.exe Token: SeSystemEnvironmentPrivilege 3896 msiexec.exe Token: SeChangeNotifyPrivilege 3896 msiexec.exe Token: SeRemoteShutdownPrivilege 3896 msiexec.exe Token: SeUndockPrivilege 3896 msiexec.exe Token: SeSyncAgentPrivilege 3896 msiexec.exe Token: SeEnableDelegationPrivilege 3896 msiexec.exe Token: SeManageVolumePrivilege 3896 msiexec.exe Token: SeImpersonatePrivilege 3896 msiexec.exe Token: SeCreateGlobalPrivilege 3896 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeRestorePrivilege 1424 msiexec.exe Token: SeTakeOwnershipPrivilege 1424 msiexec.exe Token: SeShutdownPrivilege 2740 svchost.exe Token: SeCreatePagefilePrivilege 2740 svchost.exe Token: SeShutdownPrivilege 2740 svchost.exe Token: SeCreatePagefilePrivilege 2740 svchost.exe Token: SeShutdownPrivilege 2740 svchost.exe Token: SeCreatePagefilePrivilege 2740 svchost.exe Token: SeSecurityPrivilege 2800 TiWorker.exe Token: SeRestorePrivilege 2800 TiWorker.exe Token: SeBackupPrivilege 2800 TiWorker.exe Token: SeTcbPrivilege 1600 svchost.exe Token: SeTcbPrivilege 1600 svchost.exe Token: SeTcbPrivilege 1600 svchost.exe Token: SeTcbPrivilege 1600 svchost.exe Token: SeTcbPrivilege 1600 svchost.exe Token: SeBackupPrivilege 2800 TiWorker.exe Token: SeRestorePrivilege 2800 TiWorker.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
Processes:
msiexec.exemsedge.exepid process 3896 msiexec.exe 3896 msiexec.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe -
Suspicious use of SendNotifyMessage 16 IoCs
Processes:
msedge.exepid process 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msiexec.exeMsiExec.execmd.exemsedge.exedescription pid process target process PID 1424 wrote to memory of 4860 1424 msiexec.exe MsiExec.exe PID 1424 wrote to memory of 4860 1424 msiexec.exe MsiExec.exe PID 1424 wrote to memory of 4860 1424 msiexec.exe MsiExec.exe PID 4860 wrote to memory of 964 4860 MsiExec.exe cmd.exe PID 4860 wrote to memory of 964 4860 MsiExec.exe cmd.exe PID 4860 wrote to memory of 964 4860 MsiExec.exe cmd.exe PID 964 wrote to memory of 4736 964 cmd.exe msedge.exe PID 964 wrote to memory of 4736 964 cmd.exe msedge.exe PID 4736 wrote to memory of 3856 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 3856 4736 msedge.exe msedge.exe PID 4860 wrote to memory of 3656 4860 MsiExec.exe lcD07C.tmp PID 4860 wrote to memory of 3656 4860 MsiExec.exe lcD07C.tmp PID 4860 wrote to memory of 3656 4860 MsiExec.exe lcD07C.tmp PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2156 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2108 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 2108 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe PID 4736 wrote to memory of 1240 4736 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8aa574ba92ef3177d786c519d9f2acc86aa7d16afd44819cb23eddd28720776c.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2F7EEF3E5D452BB69F864F39A2875CF02⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adobe.ly/2RY5GJR4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffb2acd46f8,0x7ffb2acd4708,0x7ffb2acd47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3280 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0xec,0x134,0x120,0x210,0x7ff6c90d5460,0x7ff6c90d5470,0x7ff6c90d54806⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4844174275437386259,5900877308660396837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\lcD07C.tmp"C:\Users\Admin\AppData\Local\Temp\lcD07C.tmp"3⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lcD07C.tmpMD5
55ffee241709ae96cf64cb0b9a96f0d7
SHA1b191810094dd2ee6b13c0d33458fafcd459681ae
SHA25664bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf
SHA51201d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07
-
C:\Users\Admin\AppData\Local\Temp\lcD07C.tmpMD5
55ffee241709ae96cf64cb0b9a96f0d7
SHA1b191810094dd2ee6b13c0d33458fafcd459681ae
SHA25664bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf
SHA51201d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07
-
C:\Windows\Installer\MSICEC7.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSICEC7.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSICF93.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSICF93.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSID040.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSID040.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSID216.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSID216.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
\??\pipe\LOCAL\crashpad_4736_EJHPJVBMOAVSTYQKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/752-140-0x00000181AC340000-0x00000181AC350000-memory.dmpFilesize
64KB
-
memory/752-141-0x00000181ACF20000-0x00000181ACF30000-memory.dmpFilesize
64KB
-
memory/752-142-0x00000181AF2C0000-0x00000181AF2C4000-memory.dmpFilesize
16KB
-
memory/2156-144-0x00007FFB48E40000-0x00007FFB48E41000-memory.dmpFilesize
4KB
-
memory/2740-160-0x000001A0B1290000-0x000001A0B1294000-memory.dmpFilesize
16KB