07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9

Analysis

max time kernel
148s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 14:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe
Size

73KB
MD5

726aa28344c2404bee0e31356f491a20
SHA1

6da3844646c2b0ffdff69229a922a7441a8f3088
SHA256

07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9
SHA512

56b9a9334230eae585f0c40d2586908b8a3b0df70658512be53ae822ac6258d828fbd09b41b2545a67a6bea43b5b7307de7d2ea030369de20bcea0ea547a9554
SSDEEP

1536:FKeLlAxds0lBg6Ujo9JmNQzO9zYUm8ozYMqSXqSQqCzSXzSQzbySXySQyb8SX8Sp:EM5jX1c+wmV5LHId2DE

Score

6^/10

microsoft persistence phishing

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\16e539d3-5e02-4dae-bfa0-6bc3c46e3757.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221002205623.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1856	msedge.exe
1856	msedge.exe
4020	msedge.exe
4020	msedge.exe
4252	msedge.exe
4252	msedge.exe
4856	identity_helper.exe
4856	identity_helper.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4252 msedge.exe
4252 msedge.exe
4252 msedge.exe
4252 msedge.exe
4252 msedge.exe
4252 msedge.exe
4252 msedge.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

4252 msedge.exe
4252 msedge.exe

pid	process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

pid	process
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exemsedge.exemsedge.exe

description	pid	process	target process
PID 2508 wrote to memory of 4252	2508	07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe	msedge.exe
PID 2508 wrote to memory of 4252	2508	07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe	msedge.exe
PID 4252 wrote to memory of 2796	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 2796	4252	msedge.exe	msedge.exe
PID 2508 wrote to memory of 112	2508	07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe	msedge.exe
PID 2508 wrote to memory of 112	2508	07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe	msedge.exe
PID 112 wrote to memory of 4056	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 4056	112	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1368	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1856	4252	msedge.exe	msedge.exe
PID 4252 wrote to memory of 1856	4252	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe
PID 112 wrote to memory of 372	112	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe
"C:\Users\Admin\AppData\Local\Temp\07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x40,0x7ffe630146f8,0x7ffe63014708,0x7ffe63014718
3⤵
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
3⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:8
3⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
3⤵
PID:528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
3⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
3⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5444 /prefetch:8
3⤵
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
3⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
3⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6420 /prefetch:8
3⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
3⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
3⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7036 /prefetch:8
3⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6e1c75460,0x7ff6e1c75470,0x7ff6e1c75480
4⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7036 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6160 /prefetch:8
3⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9514938510294279417,15647465287648267857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6132 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=07d1a892ca9b5152abfd485a4a3293ee347b6891701156566ae11e7281d7a9a9.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe630146f8,0x7ffe63014708,0x7ffe63014718
3⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17973837849188020290,1296423963018471054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
3⤵
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17973837849188020290,1296423963018471054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Filesize
471B

MD5
18c5ce66b5fb6e5f744da99e7bf49c2d

SHA1
ebc776924a1095dfd21379a8df954995ff5c54bf

SHA256
e3f8d374fb04424f91bc57bccbd493cac0fc6e66506b1fed05a4d5aeb5ecd9e9

SHA512
63f9420456899909c25f81e89bd99d8c4f1c66488c03d7de814d81844be27a28854dadbb3e54f307ceef48b4afe577c4a2c0c9dff4f42e3fe38246f8c0f4c8b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Filesize
416B

MD5
5c0a1417495b6946081b19060fe06981

SHA1
dd3e7a5f4bc949520b2c7dd0e3b21342f38426da

SHA256
294a06e25dff12aa444cda13f2d6282371cf992692f05844a119760b7d419d3d

SHA512
b8442a2d5e0c9a256a2fd58a09306f2df7cc15b6760e208335c223427ce70050dc6ea81128f7dd6d7008bff255c5790cde8f2b94b2ea087248ea80bbfb196d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
3d215f745ec2abd11543703233aef68b

SHA1
739c4f7fe44a4d4407411b7f3bf42eeb05666792

SHA256
4ce72d3c52ec213330837e8c6e58fd7dfc5f89af633deb93da047743e571eaa0

SHA512
7bfd066bb29a016b0da08ea2e1c8e8abb757fb2adf32e9cfc21f77d9477bb5662752bc4a5f14b115208ef31c4c508f635a52b445fdcdd738332bf7e68c552d65

Download Submit
\??\pipe\LOCAL\crashpad_112_RHYVOYEUZUICWKJV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4252_MQJZNMNTVWVCAHSP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/112-134-0x0000000000000000-mapping.dmp

Download
memory/372-144-0x0000000000000000-mapping.dmp

Download
memory/528-151-0x0000000000000000-mapping.dmp

Download
memory/1060-176-0x0000000000000000-mapping.dmp

Download
memory/1068-159-0x0000000000000000-mapping.dmp

Download
memory/1368-140-0x0000000000000000-mapping.dmp

Download
memory/1624-155-0x0000000000000000-mapping.dmp

Download
memory/1856-141-0x0000000000000000-mapping.dmp

Download
memory/2152-153-0x0000000000000000-mapping.dmp

Download
memory/2212-170-0x0000000000000000-mapping.dmp

Download
memory/2460-172-0x0000000000000000-mapping.dmp

Download
memory/2724-146-0x0000000000000000-mapping.dmp

Download
memory/2796-133-0x0000000000000000-mapping.dmp

Download
memory/3000-171-0x0000000000000000-mapping.dmp

Download
memory/3452-164-0x0000000000000000-mapping.dmp

Download
memory/3500-166-0x0000000000000000-mapping.dmp

Download
memory/4020-147-0x0000000000000000-mapping.dmp

Download
memory/4056-135-0x0000000000000000-mapping.dmp

Download
memory/4252-132-0x0000000000000000-mapping.dmp

Download
memory/4364-175-0x0000000000000000-mapping.dmp

Download
memory/4512-168-0x0000000000000000-mapping.dmp

Download
memory/4856-173-0x0000000000000000-mapping.dmp

Download
memory/4900-162-0x0000000000000000-mapping.dmp

Download