Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
07-03-2022 11:10
Static task
static1
Behavioral task
behavioral1
Sample
91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe
Resource
win10v2004-en-20220113
General
-
Target
91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe
-
Size
99KB
-
MD5
2a63d88b403e251d2587eb0fa5972356
-
SHA1
d854b2e080cae641d50c09b5cc3e6bb2454c8ded
-
SHA256
91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16
-
SHA512
ffbcee55035f3c2c83e4d856c2a1badfc690e22cffdd14a4ead46990ee24baf96cda399ad6312e94d8ce0e05c00a91d2a25751370144f43743e6447fa54c21ce
Malware Config
Signatures
-
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
RevengeRat Executable 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1068-134-0x0000000000400000-0x0000000000416000-memory.dmp revengerat behavioral2/memory/1068-136-0x0000000000400000-0x0000000000416000-memory.dmp revengerat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exedescription pid process target process PID 940 set thread context of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\03ebdd30-e347-48bc-a8c5-b0725658d2e0.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220129010633.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1900 msedge.exe 1900 msedge.exe 2580 msedge.exe 2580 msedge.exe 3492 identity_helper.exe 3492 identity_helper.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe 3788 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
svchost.exedescription pid process Token: SeTcbPrivilege 3468 svchost.exe Token: SeTcbPrivilege 3468 svchost.exe Token: SeTcbPrivilege 3468 svchost.exe Token: SeTcbPrivilege 3468 svchost.exe Token: SeTcbPrivilege 3468 svchost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exesvchost.exemsedge.exedescription pid process target process PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 940 wrote to memory of 1068 940 91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe svchost.exe PID 1068 wrote to memory of 2580 1068 svchost.exe msedge.exe PID 1068 wrote to memory of 2580 1068 svchost.exe msedge.exe PID 2580 wrote to memory of 1412 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 1412 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 4252 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 1900 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 1900 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe PID 2580 wrote to memory of 3392 2580 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe"C:\Users\Admin\AppData\Local\Temp\91634dbbc3ac12dee468234cb1bab87e8875b940eae02c29e05611ec18e2cd16.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\svchost.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a70646f8,0x7ff9a7064708,0x7ff9a70647184⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:24⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2980 /prefetch:84⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:14⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:14⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5364 /prefetch:84⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:14⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:14⤵PID:2016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:14⤵PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:14⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:14⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:84⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
PID:4596 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0xec,0x22c,0x7ff775cb5460,0x7ff775cb5470,0x7ff775cb54805⤵PID:4336
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6740 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4196 /prefetch:84⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 /prefetch:84⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:84⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12507138472564564247,15330664053795610181,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6276 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.03⤵PID:3044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a70646f8,0x7ff9a7064708,0x7ff9a70647184⤵PID:1592
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3468
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ee62affb981b3e9a3246eef79249ad40
SHA1a1c3564d86bb6341894e1efa65cd923a5c280c8f
SHA2564a3834071a2ac2372115d0e1146132f41a1497b6616d822eb926bf3ab32dc1ca
SHA5121450bfd79cbedfb186adfd9f7f2ff9c9296ffd5badae62048bbc67f808d431325ab5afbcc980251833a93f28dc3d6a74d2febdaf6d46697eacfac53c82b2acc4
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e