Analysis
-
max time kernel
159s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 10:46
Static task
static1
Behavioral task
behavioral1
Sample
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
Resource
win10v2004-en-20220113
General
-
Target
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
-
Size
639KB
-
MD5
2e299b1fcf357f678bbf00a06ead424f
-
SHA1
58f5f158f679b5a031dfc0e1323fd7a4dc24c3f4
-
SHA256
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995
-
SHA512
37cb0f8d929b793b5bf20f291de10b863cc63b59d2a990c07b4df4f1c64149ee335bf4961f7ac50390b614516f862fb7b3a38d7162ed4f91ba6e56685b4a1400
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
MsiExec.exeflow pid process 31 1500 MsiExec.exe 33 1500 MsiExec.exe -
Executes dropped EXE 1 IoCs
Processes:
lc976B.tmppid process 4076 lc976B.tmp -
Loads dropped DLL 5 IoCs
Processes:
MsiExec.exepid process 1500 MsiExec.exe 1500 MsiExec.exe 1500 MsiExec.exe 1500 MsiExec.exe 1500 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2fd9c2b1-aa43-4016-a938-15d65003117e.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220213104830.pma setup.exe -
Drops file in Windows directory 20 IoCs
Processes:
msiexec.exesvchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\Installer\MSI75E9.tmp msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\Installer\MSI9710.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\1cd724f.msi msiexec.exe File opened for modification C:\Windows\Installer\1cd724f.msi msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Installer\MSI9643.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI981B.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{981256CA-88C2-4337-81ED-3C74ED6193B5} msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\Installer\MSI9FAD.tmp msiexec.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI96C1.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msiexec.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4920 msiexec.exe 4920 msiexec.exe 1040 msedge.exe 1040 msedge.exe 2200 msedge.exe 2200 msedge.exe 3948 identity_helper.exe 3948 identity_helper.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
msedge.exepid process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exesvchost.exeTiWorker.exedescription pid process Token: SeShutdownPrivilege 4676 msiexec.exe Token: SeIncreaseQuotaPrivilege 4676 msiexec.exe Token: SeSecurityPrivilege 4920 msiexec.exe Token: SeCreateTokenPrivilege 4676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4676 msiexec.exe Token: SeLockMemoryPrivilege 4676 msiexec.exe Token: SeIncreaseQuotaPrivilege 4676 msiexec.exe Token: SeMachineAccountPrivilege 4676 msiexec.exe Token: SeTcbPrivilege 4676 msiexec.exe Token: SeSecurityPrivilege 4676 msiexec.exe Token: SeTakeOwnershipPrivilege 4676 msiexec.exe Token: SeLoadDriverPrivilege 4676 msiexec.exe Token: SeSystemProfilePrivilege 4676 msiexec.exe Token: SeSystemtimePrivilege 4676 msiexec.exe Token: SeProfSingleProcessPrivilege 4676 msiexec.exe Token: SeIncBasePriorityPrivilege 4676 msiexec.exe Token: SeCreatePagefilePrivilege 4676 msiexec.exe Token: SeCreatePermanentPrivilege 4676 msiexec.exe Token: SeBackupPrivilege 4676 msiexec.exe Token: SeRestorePrivilege 4676 msiexec.exe Token: SeShutdownPrivilege 4676 msiexec.exe Token: SeDebugPrivilege 4676 msiexec.exe Token: SeAuditPrivilege 4676 msiexec.exe Token: SeSystemEnvironmentPrivilege 4676 msiexec.exe Token: SeChangeNotifyPrivilege 4676 msiexec.exe Token: SeRemoteShutdownPrivilege 4676 msiexec.exe Token: SeUndockPrivilege 4676 msiexec.exe Token: SeSyncAgentPrivilege 4676 msiexec.exe Token: SeEnableDelegationPrivilege 4676 msiexec.exe Token: SeManageVolumePrivilege 4676 msiexec.exe Token: SeImpersonatePrivilege 4676 msiexec.exe Token: SeCreateGlobalPrivilege 4676 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeShutdownPrivilege 1616 svchost.exe Token: SeCreatePagefilePrivilege 1616 svchost.exe Token: SeShutdownPrivilege 1616 svchost.exe Token: SeCreatePagefilePrivilege 1616 svchost.exe Token: SeShutdownPrivilege 1616 svchost.exe Token: SeCreatePagefilePrivilege 1616 svchost.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeSecurityPrivilege 4460 TiWorker.exe Token: SeRestorePrivilege 4460 TiWorker.exe Token: SeBackupPrivilege 4460 TiWorker.exe Token: SeBackupPrivilege 4460 TiWorker.exe Token: SeRestorePrivilege 4460 TiWorker.exe Token: SeSecurityPrivilege 4460 TiWorker.exe Token: SeBackupPrivilege 4460 TiWorker.exe Token: SeRestorePrivilege 4460 TiWorker.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
msiexec.exemsedge.exepid process 4676 msiexec.exe 4676 msiexec.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
msedge.exepid process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msiexec.exeMsiExec.execmd.exemsedge.exedescription pid process target process PID 4920 wrote to memory of 1500 4920 msiexec.exe MsiExec.exe PID 4920 wrote to memory of 1500 4920 msiexec.exe MsiExec.exe PID 4920 wrote to memory of 1500 4920 msiexec.exe MsiExec.exe PID 1500 wrote to memory of 2072 1500 MsiExec.exe cmd.exe PID 1500 wrote to memory of 2072 1500 MsiExec.exe cmd.exe PID 1500 wrote to memory of 2072 1500 MsiExec.exe cmd.exe PID 2072 wrote to memory of 2200 2072 cmd.exe msedge.exe PID 2072 wrote to memory of 2200 2072 cmd.exe msedge.exe PID 2200 wrote to memory of 796 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 796 2200 msedge.exe msedge.exe PID 1500 wrote to memory of 4076 1500 MsiExec.exe lc976B.tmp PID 1500 wrote to memory of 4076 1500 MsiExec.exe lc976B.tmp PID 1500 wrote to memory of 4076 1500 MsiExec.exe lc976B.tmp PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 4028 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 1040 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 1040 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe PID 2200 wrote to memory of 368 2200 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C19BCCAED271F799B27301D95D000402⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adobe.ly/2RY5GJR4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8f89f46f8,0x7ff8f89f4708,0x7ff8f89f47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff704795460,0x7ff704795470,0x7ff7047954806⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7160 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3644 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\lc976B.tmp"C:\Users\Admin\AppData\Local\Temp\lc976B.tmp"3⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lc976B.tmpMD5
55ffee241709ae96cf64cb0b9a96f0d7
SHA1b191810094dd2ee6b13c0d33458fafcd459681ae
SHA25664bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf
SHA51201d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07
-
C:\Users\Admin\AppData\Local\Temp\lc976B.tmpMD5
55ffee241709ae96cf64cb0b9a96f0d7
SHA1b191810094dd2ee6b13c0d33458fafcd459681ae
SHA25664bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf
SHA51201d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07
-
C:\Windows\Installer\MSI75E9.tmpMD5
318dea4099b577bc51ae5e21eb8c566d
SHA1e3a4d3245bc40ca956c3a5081dcfd74e98fb1510
SHA256f335e99ea0a95b99e32d6b60c67621db8e5d096e9d77a0c8f2defcde8f32f54f
SHA51265d4886bc19c9b9f36d68c07b83f687cdb75f95cde5f5ef02289502518c58f77c99ef2548d25f69bff6f0bfefe7fc7bb18fd010c4341c15114675f80f3d85844
-
C:\Windows\Installer\MSI75E9.tmpMD5
318dea4099b577bc51ae5e21eb8c566d
SHA1e3a4d3245bc40ca956c3a5081dcfd74e98fb1510
SHA256f335e99ea0a95b99e32d6b60c67621db8e5d096e9d77a0c8f2defcde8f32f54f
SHA51265d4886bc19c9b9f36d68c07b83f687cdb75f95cde5f5ef02289502518c58f77c99ef2548d25f69bff6f0bfefe7fc7bb18fd010c4341c15114675f80f3d85844
-
C:\Windows\Installer\MSI9643.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSI9643.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSI96C1.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSI96C1.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSI9710.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSI9710.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSI981B.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
C:\Windows\Installer\MSI981B.tmpMD5
9f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
\??\pipe\LOCAL\crashpad_2200_XJXUXLKULFPJCFXEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1616-134-0x0000029DD38F0000-0x0000029DD38F4000-memory.dmpFilesize
16KB
-
memory/1616-133-0x0000029DD1220000-0x0000029DD1230000-memory.dmpFilesize
64KB
-
memory/1616-132-0x0000029DD0B70000-0x0000029DD0B80000-memory.dmpFilesize
64KB
-
memory/4028-146-0x00007FF917DE0000-0x00007FF917DE1000-memory.dmpFilesize
4KB