Analysis
-
max time kernel
159s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
13-02-2022 10:46
Static task
static1
Behavioral task
behavioral1
Sample
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi
-
Size
639KB
-
MD5
2e299b1fcf357f678bbf00a06ead424f
-
SHA1
58f5f158f679b5a031dfc0e1323fd7a4dc24c3f4
-
SHA256
0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995
-
SHA512
37cb0f8d929b793b5bf20f291de10b863cc63b59d2a990c07b4df4f1c64149ee335bf4961f7ac50390b614516f862fb7b3a38d7162ed4f91ba6e56685b4a1400
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 31 1500 MsiExec.exe 33 1500 MsiExec.exe -
Executes dropped EXE 1 IoCs
pid Process 4076 lc976B.tmp -
Loads dropped DLL 5 IoCs
pid Process 1500 MsiExec.exe 1500 MsiExec.exe 1500 MsiExec.exe 1500 MsiExec.exe 1500 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2fd9c2b1-aa43-4016-a938-15d65003117e.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220213104830.pma setup.exe -
Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI75E9.tmp msiexec.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\Installer\MSI9710.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\1cd724f.msi msiexec.exe File opened for modification C:\Windows\Installer\1cd724f.msi msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Installer\MSI9643.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI981B.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{981256CA-88C2-4337-81ED-3C74ED6193B5} msiexec.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\Installer\MSI9FAD.tmp msiexec.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI96C1.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4920 msiexec.exe 4920 msiexec.exe 1040 msedge.exe 1040 msedge.exe 2200 msedge.exe 2200 msedge.exe 3948 identity_helper.exe 3948 identity_helper.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4676 msiexec.exe Token: SeIncreaseQuotaPrivilege 4676 msiexec.exe Token: SeSecurityPrivilege 4920 msiexec.exe Token: SeCreateTokenPrivilege 4676 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4676 msiexec.exe Token: SeLockMemoryPrivilege 4676 msiexec.exe Token: SeIncreaseQuotaPrivilege 4676 msiexec.exe Token: SeMachineAccountPrivilege 4676 msiexec.exe Token: SeTcbPrivilege 4676 msiexec.exe Token: SeSecurityPrivilege 4676 msiexec.exe Token: SeTakeOwnershipPrivilege 4676 msiexec.exe Token: SeLoadDriverPrivilege 4676 msiexec.exe Token: SeSystemProfilePrivilege 4676 msiexec.exe Token: SeSystemtimePrivilege 4676 msiexec.exe Token: SeProfSingleProcessPrivilege 4676 msiexec.exe Token: SeIncBasePriorityPrivilege 4676 msiexec.exe Token: SeCreatePagefilePrivilege 4676 msiexec.exe Token: SeCreatePermanentPrivilege 4676 msiexec.exe Token: SeBackupPrivilege 4676 msiexec.exe Token: SeRestorePrivilege 4676 msiexec.exe Token: SeShutdownPrivilege 4676 msiexec.exe Token: SeDebugPrivilege 4676 msiexec.exe Token: SeAuditPrivilege 4676 msiexec.exe Token: SeSystemEnvironmentPrivilege 4676 msiexec.exe Token: SeChangeNotifyPrivilege 4676 msiexec.exe Token: SeRemoteShutdownPrivilege 4676 msiexec.exe Token: SeUndockPrivilege 4676 msiexec.exe Token: SeSyncAgentPrivilege 4676 msiexec.exe Token: SeEnableDelegationPrivilege 4676 msiexec.exe Token: SeManageVolumePrivilege 4676 msiexec.exe Token: SeImpersonatePrivilege 4676 msiexec.exe Token: SeCreateGlobalPrivilege 4676 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeShutdownPrivilege 1616 svchost.exe Token: SeCreatePagefilePrivilege 1616 svchost.exe Token: SeShutdownPrivilege 1616 svchost.exe Token: SeCreatePagefilePrivilege 1616 svchost.exe Token: SeShutdownPrivilege 1616 svchost.exe Token: SeCreatePagefilePrivilege 1616 svchost.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeRestorePrivilege 4920 msiexec.exe Token: SeTakeOwnershipPrivilege 4920 msiexec.exe Token: SeSecurityPrivilege 4460 TiWorker.exe Token: SeRestorePrivilege 4460 TiWorker.exe Token: SeBackupPrivilege 4460 TiWorker.exe Token: SeBackupPrivilege 4460 TiWorker.exe Token: SeRestorePrivilege 4460 TiWorker.exe Token: SeSecurityPrivilege 4460 TiWorker.exe Token: SeBackupPrivilege 4460 TiWorker.exe Token: SeRestorePrivilege 4460 TiWorker.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 4676 msiexec.exe 4676 msiexec.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1500 4920 msiexec.exe 83 PID 4920 wrote to memory of 1500 4920 msiexec.exe 83 PID 4920 wrote to memory of 1500 4920 msiexec.exe 83 PID 1500 wrote to memory of 2072 1500 MsiExec.exe 88 PID 1500 wrote to memory of 2072 1500 MsiExec.exe 88 PID 1500 wrote to memory of 2072 1500 MsiExec.exe 88 PID 2072 wrote to memory of 2200 2072 cmd.exe 90 PID 2072 wrote to memory of 2200 2072 cmd.exe 90 PID 2200 wrote to memory of 796 2200 msedge.exe 92 PID 2200 wrote to memory of 796 2200 msedge.exe 92 PID 1500 wrote to memory of 4076 1500 MsiExec.exe 95 PID 1500 wrote to memory of 4076 1500 MsiExec.exe 95 PID 1500 wrote to memory of 4076 1500 MsiExec.exe 95 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 4028 2200 msedge.exe 96 PID 2200 wrote to memory of 1040 2200 msedge.exe 97 PID 2200 wrote to memory of 1040 2200 msedge.exe 97 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100 PID 2200 wrote to memory of 368 2200 msedge.exe 100
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0113d8a67b61dd6163b003c806d997f1f26da9df316744571aa1295c7ffb9995.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4676
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4C19BCCAED271F799B27301D95D000402⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR3⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adobe.ly/2RY5GJR4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8f89f46f8,0x7ff8f89f4708,0x7ff8f89f47185⤵PID:796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:25⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 /prefetch:85⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:15⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:15⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:15⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:15⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:15⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:85⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
PID:4552 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff704795460,0x7ff704795470,0x7ff7047954806⤵PID:1656
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7160 /prefetch:85⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:85⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,18351810512481497161,17971181364876228911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3644 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\lc976B.tmp"C:\Users\Admin\AppData\Local\Temp\lc976B.tmp"3⤵
- Executes dropped EXE
PID:4076
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3228
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:4944