Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:48
Static task
static1
Behavioral task
behavioral1
Sample
2vFTA23042049-ABRIL.msi
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2vFTA23042049-ABRIL.msi
Resource
win10v2004-20220414-en
General
-
Target
2vFTA23042049-ABRIL.msi
-
Size
280KB
-
MD5
04e7028611b3a265f90a627f45e43721
-
SHA1
10cc07c9d057baff07aa81e5f6c3833f8c763f8d
-
SHA256
c51857627b43582a7f2995c27356717b474854716ddffabcc4ec03b0085bcc07
-
SHA512
e6f39b4e3d934eae2a47e2ee382c7560e3c8852e95d2ce72ee1a6eb31e92b8e102a922638077b16f31ebdb9da92e932649f43d755627b0c5a1c45bff360b5382
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
MsiExec.exeflow pid process 3 4696 MsiExec.exe 16 4696 MsiExec.exe -
Executes dropped EXE 1 IoCs
Processes:
lcDC2C.tmppid process 4668 lcDC2C.tmp -
Loads dropped DLL 4 IoCs
Processes:
MsiExec.exepid process 4696 MsiExec.exe 4696 MsiExec.exe 4696 MsiExec.exe 4696 MsiExec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\74318e01-4082-4b04-8d40-761978bcd013.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220520052804.pma setup.exe -
Drops file in Windows directory 11 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\Installer\e56be05.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDAD5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDBEF.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{F3B7D2E0-C1FB-475A-A8E7-BA8F7156AE04} msiexec.exe File opened for modification C:\Windows\Installer\MSIE4FA.tmp msiexec.exe File opened for modification C:\Windows\Installer\e56be05.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID69E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDFB9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsiexec.exeidentity_helper.exemsedge.exepid process 5020 msedge.exe 5020 msedge.exe 4800 msedge.exe 4800 msedge.exe 4220 msiexec.exe 4220 msiexec.exe 4488 identity_helper.exe 4488 identity_helper.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe 704 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
msedge.exepid process 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 4388 msiexec.exe Token: SeIncreaseQuotaPrivilege 4388 msiexec.exe Token: SeSecurityPrivilege 4220 msiexec.exe Token: SeCreateTokenPrivilege 4388 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4388 msiexec.exe Token: SeLockMemoryPrivilege 4388 msiexec.exe Token: SeIncreaseQuotaPrivilege 4388 msiexec.exe Token: SeMachineAccountPrivilege 4388 msiexec.exe Token: SeTcbPrivilege 4388 msiexec.exe Token: SeSecurityPrivilege 4388 msiexec.exe Token: SeTakeOwnershipPrivilege 4388 msiexec.exe Token: SeLoadDriverPrivilege 4388 msiexec.exe Token: SeSystemProfilePrivilege 4388 msiexec.exe Token: SeSystemtimePrivilege 4388 msiexec.exe Token: SeProfSingleProcessPrivilege 4388 msiexec.exe Token: SeIncBasePriorityPrivilege 4388 msiexec.exe Token: SeCreatePagefilePrivilege 4388 msiexec.exe Token: SeCreatePermanentPrivilege 4388 msiexec.exe Token: SeBackupPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4388 msiexec.exe Token: SeShutdownPrivilege 4388 msiexec.exe Token: SeDebugPrivilege 4388 msiexec.exe Token: SeAuditPrivilege 4388 msiexec.exe Token: SeSystemEnvironmentPrivilege 4388 msiexec.exe Token: SeChangeNotifyPrivilege 4388 msiexec.exe Token: SeRemoteShutdownPrivilege 4388 msiexec.exe Token: SeUndockPrivilege 4388 msiexec.exe Token: SeSyncAgentPrivilege 4388 msiexec.exe Token: SeEnableDelegationPrivilege 4388 msiexec.exe Token: SeManageVolumePrivilege 4388 msiexec.exe Token: SeImpersonatePrivilege 4388 msiexec.exe Token: SeCreateGlobalPrivilege 4388 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe Token: SeRestorePrivilege 4220 msiexec.exe Token: SeTakeOwnershipPrivilege 4220 msiexec.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
msiexec.exemsedge.exepid process 4388 msiexec.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4388 msiexec.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
msedge.exepid process 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe 4800 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msiexec.exeMsiExec.execmd.exemsedge.exedescription pid process target process PID 4220 wrote to memory of 4696 4220 msiexec.exe MsiExec.exe PID 4220 wrote to memory of 4696 4220 msiexec.exe MsiExec.exe PID 4220 wrote to memory of 4696 4220 msiexec.exe MsiExec.exe PID 4696 wrote to memory of 952 4696 MsiExec.exe cmd.exe PID 4696 wrote to memory of 952 4696 MsiExec.exe cmd.exe PID 4696 wrote to memory of 952 4696 MsiExec.exe cmd.exe PID 952 wrote to memory of 4800 952 cmd.exe msedge.exe PID 952 wrote to memory of 4800 952 cmd.exe msedge.exe PID 4800 wrote to memory of 4572 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 4572 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 2480 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 5020 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 5020 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe PID 4800 wrote to memory of 3596 4800 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2vFTA23042049-ABRIL.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4388
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D81B33BA76314207434DAE1492A3C4A52⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start /MAX https://adobe.ly/2RY5GJR3⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://adobe.ly/2RY5GJR4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9ae4446f8,0x7ff9ae444708,0x7ff9ae4447185⤵PID:4572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:25⤵PID:2480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:85⤵PID:3596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:15⤵PID:2264
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:15⤵PID:4224
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4948 /prefetch:85⤵PID:2276
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:15⤵PID:1516
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5476 /prefetch:85⤵PID:4412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:15⤵PID:4144
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:15⤵PID:2488
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:85⤵PID:3016
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
PID:2744 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff683d05460,0x7ff683d05470,0x7ff683d054806⤵PID:2596
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:4488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 /prefetch:85⤵PID:4384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6424 /prefetch:85⤵PID:548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:85⤵PID:5044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5088 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:704 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4756 /prefetch:85⤵PID:1344
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1820,6363503264521741674,17991850671712111970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:85⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\lcDC2C.tmp"C:\Users\Admin\AppData\Local\Temp\lcDC2C.tmp"3⤵
- Executes dropped EXE
PID:4668
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3960
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD555ffee241709ae96cf64cb0b9a96f0d7
SHA1b191810094dd2ee6b13c0d33458fafcd459681ae
SHA25664bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf
SHA51201d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07
-
Filesize
12KB
MD555ffee241709ae96cf64cb0b9a96f0d7
SHA1b191810094dd2ee6b13c0d33458fafcd459681ae
SHA25664bc6cf6b6e9850cea2a36cabc88982b0b936dd7f0bc169a2f6dd2a5d1e86abf
SHA51201d05a5f34be950ec660af9e1de5c7d3c0e473f7815c2e13157c0b7bf162ca5a6b34fabc3704ba6e4fb339a53b1a20862fe984e16feca81f45cf4a0f98e01c07
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
Filesize
91KB
MD59f1e5d66c2889018daef4aef604eebc4
SHA1b80294261c8a1635e16e14f55a3d76889ff2c857
SHA25602a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
SHA5128f8cbba79d2b6541e8b603a4a395cb938d77c358563bd745449bfee107ee64b88254a79ca5dd72fa05798a75c1464e7cca52556829f258009a3d33c9c3c5d39b
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e