amadey | 74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b

Analysis

max time kernel
174s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22-05-2022 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
Size

336KB
MD5

53f54f7688b7becf3f68ca1ac3cb3565
SHA1

b99a8ee9253186f3a19e750e4b9a7cecedb30136
SHA256

74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b
SHA512

a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad

Score

10^/10

amadey microsoft persistence phishing suricata trojan

Malware Config

Extracted

Family

amadey

Version

3.10

185.215.113.35/d2VxjasuwS_old/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

orxds.exeorxds.exeorxds.exeorxds.exe

pid process

3700 orxds.exe
3608 orxds.exe
1788 orxds.exe
796 orxds.exe

pid	process
3700	orxds.exe
3608	orxds.exe
1788	orxds.exe
796	orxds.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exeorxds.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	orxds.exe

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe
Detected potential entity reuse from brand microsoft.
phishing microsoft
Suspicious use of SetThreadContext 1 IoCs

Processes:

orxds.exe

description pid process target process

PID 3700 set thread context of 3608 3700 orxds.exe orxds.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

description	pid	process	target process
PID 3700 set thread context of 3608	3700	orxds.exe	orxds.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\60823f06-31b2-4227-9c93-519707b0e618.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220522155746.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4792	4520	WerFault.exe	74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
3256	1788	WerFault.exe	orxds.exe
4412	796	WerFault.exe	orxds.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2276 schtasks.exe

pid	process
2276	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

4452 msedge.exe
4452 msedge.exe
4840 msedge.exe
4840 msedge.exe
1332 msedge.exe
1332 msedge.exe
3648 identity_helper.exe
3648 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
1332 msedge.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

1332 msedge.exe
1332 msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
4452	msedge.exe
4452	msedge.exe
4840	msedge.exe
4840	msedge.exe
1332	msedge.exe
1332	msedge.exe
3648	identity_helper.exe
3648	identity_helper.exe

pid	process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

pid	process
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exeorxds.execmd.exeorxds.exemsedge.exemsedge.exe

description	pid	process	target process
PID 4520 wrote to memory of 3700	4520	74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe	orxds.exe
PID 4520 wrote to memory of 3700	4520	74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe	orxds.exe
PID 4520 wrote to memory of 3700	4520	74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe	orxds.exe
PID 3700 wrote to memory of 2616	3700	orxds.exe	cmd.exe
PID 3700 wrote to memory of 2616	3700	orxds.exe	cmd.exe
PID 3700 wrote to memory of 2616	3700	orxds.exe	cmd.exe
PID 3700 wrote to memory of 2276	3700	orxds.exe	schtasks.exe
PID 3700 wrote to memory of 2276	3700	orxds.exe	schtasks.exe
PID 3700 wrote to memory of 2276	3700	orxds.exe	schtasks.exe
PID 2616 wrote to memory of 2704	2616	cmd.exe	reg.exe
PID 2616 wrote to memory of 2704	2616	cmd.exe	reg.exe
PID 2616 wrote to memory of 2704	2616	cmd.exe	reg.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3700 wrote to memory of 3608	3700	orxds.exe	orxds.exe
PID 3608 wrote to memory of 1240	3608	orxds.exe	msedge.exe
PID 3608 wrote to memory of 1240	3608	orxds.exe	msedge.exe
PID 1240 wrote to memory of 2072	1240	msedge.exe	msedge.exe
PID 1240 wrote to memory of 2072	1240	msedge.exe	msedge.exe
PID 3608 wrote to memory of 1332	3608	orxds.exe	msedge.exe
PID 3608 wrote to memory of 1332	3608	orxds.exe	msedge.exe
PID 1332 wrote to memory of 1632	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 1632	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe
PID 1332 wrote to memory of 2436	1332	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe
"C:\Users\Admin\AppData\Local\Temp\74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
"C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\d273120da5\
3⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\d273120da5\
4⤵
PID:2704

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN orxds.exe /TR "C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe" /F
3⤵
- Creates scheduled task(s)
PID:2276

C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
"C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=orxds.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
4⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffcb0e146f8,0x7ffcb0e14708,0x7ffcb0e14718
5⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17873414173297840368,874826013276008928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
5⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17873414173297840368,874826013276008928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=orxds.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
5⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
5⤵
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:1
5⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
5⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
5⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5580 /prefetch:8
5⤵
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
5⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
5⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
5⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
5⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 /prefetch:8
5⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
- Drops file in Program Files directory
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff68ca65460,0x7ff68ca65470,0x7ff68ca65480
6⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5376212418139558821,12712658800249517355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6868 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 864
2⤵
- Program crash
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4520 -ip 4520
1⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcb0e146f8,0x7ffcb0e14708,0x7ffcb0e14718
1⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 256
2⤵
- Program crash
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1788 -ip 1788
1⤵
PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1448

C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
1⤵
- Executes dropped EXE
PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 492
2⤵
- Program crash
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 796 -ip 796
1⤵
PID:3076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
Filesize
471B

MD5
4dc423160e393c8c0ad93226d15eb6d2

SHA1
0385e7335afa99659c165956afed3a932648d03b

SHA256
323df1e6fc9502c2a0c65eb5cfccd9670680645053bef738006c7aabbef1edf2

SHA512
ea602cf4824cbbd88996fa680a3525433c997ea39f787c18f0ffcb9a0f5916bebf89f4dda1586f4e53eed8a2dd0eda6967899e49d92655119911336de8e6a716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868
Filesize
442B

MD5
6aeac3be8bd05b1fd50eb86d3eae59da

SHA1
8794f2c7f1104529a25e84b609793e6a957b8537

SHA256
32ffcad95f14cbb24a27b6c3961911e3fb0507af8132f21a5dc78e28091ec648

SHA512
d3fd6cae2646696ecd0aa4d659d8c52e4f827fd8691da44c5421566b3adebaf89bb0732e461f9507c109492e4f44e04f0beb65aa94d17364dc4d2d5aed435141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
01d13441ea7758a7ef00283af3c5196f

SHA1
8740631f90858060f1beb03af8b6c014ae2f0cc5

SHA256
e8dd7cb61efbc6189bce1757dd82382dd64983932f0634b026ad06a95f314a55

SHA512
a27fd5656ffc9a0fe70d1a21f4f7224daa3841790143d779a15f09806b40ce621b61d5b41e111387a3472290780193539d86932e9c056a733447bfe10fbce4c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
01d13441ea7758a7ef00283af3c5196f

SHA1
8740631f90858060f1beb03af8b6c014ae2f0cc5

SHA256
e8dd7cb61efbc6189bce1757dd82382dd64983932f0634b026ad06a95f314a55

SHA512
a27fd5656ffc9a0fe70d1a21f4f7224daa3841790143d779a15f09806b40ce621b61d5b41e111387a3472290780193539d86932e9c056a733447bfe10fbce4c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
01d13441ea7758a7ef00283af3c5196f

SHA1
8740631f90858060f1beb03af8b6c014ae2f0cc5

SHA256
e8dd7cb61efbc6189bce1757dd82382dd64983932f0634b026ad06a95f314a55

SHA512
a27fd5656ffc9a0fe70d1a21f4f7224daa3841790143d779a15f09806b40ce621b61d5b41e111387a3472290780193539d86932e9c056a733447bfe10fbce4c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
57df4904eea85aeb7b4d9b9d9130ecad

SHA1
f6b26bbbf2a5f6645e1a400b49a8bb1c346a0cc4

SHA256
ad7f7e5f652cca952b91effac780ae3f46aa02eb9de5f18340d8f55efd8a4c68

SHA512
9ee0ab6f4e4a55f748e0177bbdac33c824c2b02cd3110fd3a0545f5885a6e4da6da3eb61f30880e5a30b29eb33274cd518f548b527f9da9cd74c8413bec57f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
52030ce72ad10c94a364f217561ac840

SHA1
fc85a85884725ea74fd57cf752ac4b20890d2aaa

SHA256
1d1f7e6272e0361f84dd93961861adbc98ce26c80435cf51bbd7831b3710a0a8

SHA512
60706e76135d5d573d8506f0bef9763dc8458a0f76e9c397e13c9907fe92717a260ab964407f489dac7397b85e84e3cf0995efadd6e6264e357af1a3e262dd81

Download Submit
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
Filesize
336KB

MD5
53f54f7688b7becf3f68ca1ac3cb3565

SHA1
b99a8ee9253186f3a19e750e4b9a7cecedb30136

SHA256
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b

SHA512
a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
Filesize
336KB

MD5
53f54f7688b7becf3f68ca1ac3cb3565

SHA1
b99a8ee9253186f3a19e750e4b9a7cecedb30136

SHA256
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b

SHA512
a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
Filesize
336KB

MD5
53f54f7688b7becf3f68ca1ac3cb3565

SHA1
b99a8ee9253186f3a19e750e4b9a7cecedb30136

SHA256
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b

SHA512
a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
Filesize
336KB

MD5
53f54f7688b7becf3f68ca1ac3cb3565

SHA1
b99a8ee9253186f3a19e750e4b9a7cecedb30136

SHA256
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b

SHA512
a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\d273120da5\orxds.exe
Filesize
336KB

MD5
53f54f7688b7becf3f68ca1ac3cb3565

SHA1
b99a8ee9253186f3a19e750e4b9a7cecedb30136

SHA256
74e1d92213c0f1cad8c5387f8ec54f7c901a76596afb9e88c30fdd6bca4f005b

SHA512
a94b97891ae3e7c202746e13912737e9047ba0f5e344ad22c6eba54e15178935db2b3e9b94eb2759294de171588a6cd42ade38dc1bdb98fd16ddafccec6591ad

Download Submit
\??\pipe\LOCAL\crashpad_1240_SRUQLHIRQRKPGLEU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_1332_TGCYUMOALDJKITQM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/632-174-0x0000000000000000-mapping.dmp

Download
memory/796-189-0x0000000000400000-0x0000000002B70000-memory.dmp

Filesize
39.4MB

Download
memory/796-188-0x0000000002E71000-0x0000000002E8F000-memory.dmp

Filesize
120KB

Download
memory/1128-164-0x0000000000000000-mapping.dmp

Download
memory/1240-144-0x0000000000000000-mapping.dmp

Download
memory/1332-146-0x0000000000000000-mapping.dmp

Download
memory/1632-147-0x0000000000000000-mapping.dmp

Download
memory/1788-153-0x0000000000400000-0x0000000002B70000-memory.dmp

Filesize
39.4MB

Download
memory/1788-150-0x0000000002BC1000-0x0000000002BDF000-memory.dmp

Filesize
120KB

Download
memory/2072-145-0x0000000000000000-mapping.dmp

Download
memory/2276-139-0x0000000000000000-mapping.dmp

Download
memory/2420-168-0x0000000000000000-mapping.dmp

Download
memory/2436-156-0x0000000000000000-mapping.dmp

Download
memory/2528-185-0x0000000000000000-mapping.dmp

Download
memory/2608-172-0x0000000000000000-mapping.dmp

Download
memory/2616-138-0x0000000000000000-mapping.dmp

Download
memory/2704-140-0x0000000000000000-mapping.dmp

Download
memory/2844-176-0x0000000000000000-mapping.dmp

Download
memory/3572-178-0x0000000000000000-mapping.dmp

Download
memory/3608-141-0x0000000000000000-mapping.dmp

Download
memory/3608-142-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/3648-186-0x0000000000000000-mapping.dmp

Download
memory/3700-133-0x0000000000000000-mapping.dmp

Download
memory/3700-136-0x0000000002B9D000-0x0000000002BBB000-memory.dmp

Filesize
120KB

Download
memory/3700-137-0x0000000000400000-0x0000000002B70000-memory.dmp

Filesize
39.4MB

Download
memory/3888-170-0x0000000000000000-mapping.dmp

Download
memory/3968-181-0x0000000000000000-mapping.dmp

Download
memory/4452-160-0x0000000000000000-mapping.dmp

Download
memory/4520-131-0x00000000048E0000-0x0000000004918000-memory.dmp

Filesize
224KB

Download
memory/4520-132-0x0000000000400000-0x0000000002B70000-memory.dmp

Filesize
39.4MB

Download
memory/4520-130-0x0000000002C3E000-0x0000000002C5C000-memory.dmp

Filesize
120KB

Download
memory/4592-183-0x0000000000000000-mapping.dmp

Download
memory/4708-158-0x0000000000000000-mapping.dmp

Download
memory/4832-184-0x0000000000000000-mapping.dmp

Download
memory/4840-159-0x0000000000000000-mapping.dmp

Download