Analysis
-
max time kernel
161s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 10:45
Static task
static1
Behavioral task
behavioral1
Sample
67255c29a1b2fcc1f9067f08fcf575a2d654e4f8d235a5a583ff2605b7728455.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
67255c29a1b2fcc1f9067f08fcf575a2d654e4f8d235a5a583ff2605b7728455.msi
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
67255c29a1b2fcc1f9067f08fcf575a2d654e4f8d235a5a583ff2605b7728455.msi
-
Size
279KB
-
MD5
6d1d353f28177bb6feb225553c552626
-
SHA1
638b8fa9a96341126cd70bc3f8454e314c0e6aba
-
SHA256
67255c29a1b2fcc1f9067f08fcf575a2d654e4f8d235a5a583ff2605b7728455
-
SHA512
cc2d5e0b5369e4ef82df06572d990a0e5f20ae0aa6c3c51b8e4bdfddb7aae6f3312413fde3e8cad32445deeebe467d2f10ec5ed412f77b62828a07fa1d1a76b7
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 19 4340 MsiExec.exe 40 4340 MsiExec.exe -
Executes dropped EXE 1 IoCs
pid Process 2476 lcD723.tmp -
Loads dropped DLL 4 IoCs
pid Process 4340 MsiExec.exe 4340 MsiExec.exe 4340 MsiExec.exe 4340 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ee34434b-ce5c-4c7f-a6be-7da5689a4669.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220213104804.pma setup.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{0A53D438-490F-48F9-A124-225F62358D50} msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Installer\MSID1E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID978.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEB2C.tmp msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\Installer\MSID5FC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID6B8.tmp msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\Installer\1cd96bf.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File created C:\Windows\Installer\1cd96bf.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5088 msedge.exe 5088 msedge.exe 2796 msiexec.exe 2796 msiexec.exe 3760 msedge.exe 3760 msedge.exe 3612 identity_helper.exe 3612 identity_helper.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe 4736 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2328 msiexec.exe Token: SeIncreaseQuotaPrivilege 2328 msiexec.exe Token: SeSecurityPrivilege 2796 msiexec.exe Token: SeCreateTokenPrivilege 2328 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2328 msiexec.exe Token: SeLockMemoryPrivilege 2328 msiexec.exe Token: SeIncreaseQuotaPrivilege 2328 msiexec.exe Token: SeMachineAccountPrivilege 2328 msiexec.exe Token: SeTcbPrivilege 2328 msiexec.exe Token: SeSecurityPrivilege 2328 msiexec.exe Token: SeTakeOwnershipPrivilege 2328 msiexec.exe Token: SeLoadDriverPrivilege 2328 msiexec.exe Token: SeSystemProfilePrivilege 2328 msiexec.exe Token: SeSystemtimePrivilege 2328 msiexec.exe Token: SeProfSingleProcessPrivilege 2328 msiexec.exe Token: SeIncBasePriorityPrivilege 2328 msiexec.exe Token: SeCreatePagefilePrivilege 2328 msiexec.exe Token: SeCreatePermanentPrivilege 2328 msiexec.exe Token: SeBackupPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2328 msiexec.exe Token: SeShutdownPrivilege 2328 msiexec.exe Token: SeDebugPrivilege 2328 msiexec.exe Token: SeAuditPrivilege 2328 msiexec.exe Token: SeSystemEnvironmentPrivilege 2328 msiexec.exe Token: SeChangeNotifyPrivilege 2328 msiexec.exe Token: SeRemoteShutdownPrivilege 2328 msiexec.exe Token: SeUndockPrivilege 2328 msiexec.exe Token: SeSyncAgentPrivilege 2328 msiexec.exe Token: SeEnableDelegationPrivilege 2328 msiexec.exe Token: SeManageVolumePrivilege 2328 msiexec.exe Token: SeImpersonatePrivilege 2328 msiexec.exe Token: SeCreateGlobalPrivilege 2328 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeRestorePrivilege 2796 msiexec.exe Token: SeTakeOwnershipPrivilege 2796 msiexec.exe Token: SeShutdownPrivilege 2376 svchost.exe Token: SeCreatePagefilePrivilege 2376 svchost.exe Token: SeShutdownPrivilege 2376 svchost.exe Token: SeCreatePagefilePrivilege 2376 svchost.exe Token: SeShutdownPrivilege 2376 svchost.exe Token: SeCreatePagefilePrivilege 2376 svchost.exe Token: SeSecurityPrivilege 3148 TiWorker.exe Token: SeRestorePrivilege 3148 TiWorker.exe Token: SeBackupPrivilege 3148 TiWorker.exe Token: SeBackupPrivilege 3148 TiWorker.exe Token: SeRestorePrivilege 3148 TiWorker.exe Token: SeSecurityPrivilege 3148 TiWorker.exe Token: SeBackupPrivilege 3148 TiWorker.exe Token: SeRestorePrivilege 3148 TiWorker.exe Token: SeSecurityPrivilege 3148 TiWorker.exe Token: SeBackupPrivilege 3148 TiWorker.exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 2328 msiexec.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 2328 msiexec.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 4340 2796 msiexec.exe 83 PID 2796 wrote to memory of 4340 2796 msiexec.exe 83 PID 2796 wrote to memory of 4340 2796 msiexec.exe 83 PID 4340 wrote to memory of 2352 4340 MsiExec.exe 84 PID 4340 wrote to memory of 2352 4340 MsiExec.exe 84 PID 4340 wrote to memory of 2352 4340 MsiExec.exe 84 PID 2352 wrote to memory of 3760 2352 cmd.exe 87 PID 2352 wrote to memory of 3760 2352 cmd.exe 87 PID 3760 wrote to memory of 212 3760 msedge.exe 89 PID 3760 wrote to memory of 212 3760 msedge.exe 89 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 1476 3760 msedge.exe 92 PID 3760 wrote to memory of 5088 3760 msedge.exe 93 PID 3760 wrote to memory of 5088 3760 msedge.exe 93 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98 PID 3760 wrote to memory of 4800 3760 msedge.exe 98
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\67255c29a1b2fcc1f9067f08fcf575a2d654e4f8d235a5a583ff2605b7728455.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2328
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DFB936772DA598052EDA6B779993F5062⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR3⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adobe.ly/2RY5GJR4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc407546f8,0x7ffc40754708,0x7ffc407547185⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:25⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3288 /prefetch:85⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:15⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:15⤵PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5416 /prefetch:85⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:15⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:15⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:15⤵PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
PID:2076 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff694515460,0x7ff694515470,0x7ff6945154806⤵PID:4020
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:85⤵PID:204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,9267191593456021552,10614975532997750276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3240 /prefetch:85⤵PID:4184
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lcD723.tmp"C:\Users\Admin\AppData\Local\Temp\lcD723.tmp"3⤵
- Executes dropped EXE
PID:2476
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3788