58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01

General

Target

58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe
Size

132KB
MD5

072670199cdc077a2a8143427b61f790
SHA1

91aa543ff059edaf622a6e1eddee31fc7dcd2b29
SHA256

58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01
SHA512

5299c70b1e675a7639ebe12492deb6acbc2407e246f14549e409a9f04ec34afef8f80b2dc6764e1226bc0709471353d753aa3adf664e37f753535a443dee7ade
SSDEEP

3072:IEtE23K8TWHsJra+MH2ajEzhZvYgcVSy7670:1jtrJnvTvy76o

Score

6^/10

microsoft persistence phishing

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ea807401-2148-48d0-ad8b-3af0e09d75fe.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221003210748.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3772	msedge.exe
3772	msedge.exe
2584	msedge.exe
2584	msedge.exe
3064	msedge.exe
3064	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3064 msedge.exe
3064 msedge.exe
3064 msedge.exe
3064 msedge.exe
3064 msedge.exe
3064 msedge.exe
3064 msedge.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

3064 msedge.exe
3064 msedge.exe

pid	process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

pid	process
3064	msedge.exe
3064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exemsedge.exemsedge.exe

description	pid	process	target process
PID 4588 wrote to memory of 4340	4588	58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe	msedge.exe
PID 4588 wrote to memory of 4340	4588	58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe	msedge.exe
PID 4340 wrote to memory of 4844	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 4844	4340	msedge.exe	msedge.exe
PID 4588 wrote to memory of 3064	4588	58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe	msedge.exe
PID 4588 wrote to memory of 3064	4588	58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe	msedge.exe
PID 3064 wrote to memory of 3848	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 3848	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 3064 wrote to memory of 4408	3064	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe
PID 4340 wrote to memory of 2840	4340	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe
"C:\Users\Admin\AppData\Local\Temp\58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Suspicious use of WriteProcessMemory
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff8857346f8,0x7ff885734708,0x7ff885734718
3⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,9892872566908377577,10657205285365707799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
3⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,9892872566908377577,10657205285365707799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=58ae9d59e6c946c0abebcca9932dd70d02a49229aaddebf26b327f7495c7ae01.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x8,0x104,0x7ff8857346f8,0x7ff885734708,0x7ff885734718
3⤵
PID:3848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
3⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
3⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
3⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
3⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
3⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5480 /prefetch:8
3⤵
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
3⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
3⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6248 /prefetch:8
3⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
3⤵
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
3⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3588 /prefetch:8
3⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0xf4,0xe0,0xcc,0xdc,0x7ff6ad355460,0x7ff6ad355470,0x7ff6ad355480
4⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3588 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:8
3⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:8
3⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12583075451799019098,11655325237075209509,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize
471B

MD5
b2eb40bbc2497cd170740d37eb1abbf5

SHA1
23875cde952221031044e734882274ee826f282d

SHA256
6dfc5aaed644f6c56fd6522a9c029e6760f32e3acdb3a4efc971919c0f5cc809

SHA512
7042aab52cfe09f04e8117b9adb8db1e6e5a38dce125cabf3d12c6337d6692f426feccf0712e9326a776087594d1a50361f709f9b86b419262b2c7193566f7f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize
412B

MD5
514b0c8a3292f450213f2f36489a64cb

SHA1
8040547c4122f1f287515345384cc1cb375acb84

SHA256
0fdbd294a772b2f5c8dc7c39e835c4dcc839fb66f82ee9846d1f3592fc9a6e87

SHA512
74d875f3852f3fc1117d1288716d5e6d0c6dbe3939d88cb9993c969c7cf68e2b067dd6da1cb86107561cd39a845866ceb3de1cf16a7b6c44468baa823bffad6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
d6bc027d2ad54584bfea53e975299ac0

SHA1
4f5ebfb29271da81ac270caafa59a418bd80831c

SHA256
e5573a7d9af00d65b6d923ebe7f03e2e30bcecd85e32404af5604773a4b344fa

SHA512
c55a7aff99f476ccfefd758198545dfc838ced1f3f9ff9dd07b5a323a175da02095c2061c7481674f21c846839995acaab03cbaa07f48efb9713735f728c9005

Download Submit
\??\pipe\LOCAL\crashpad_3064_EYKFPCCHKFGDSMKY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4340_HKDZZWVLLRFNBIBH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1028-165-0x0000000000000000-mapping.dmp

Download
memory/1376-158-0x0000000000000000-mapping.dmp

Download
memory/1440-169-0x0000000000000000-mapping.dmp

Download
memory/2236-167-0x0000000000000000-mapping.dmp

Download
memory/2416-150-0x0000000000000000-mapping.dmp

Download
memory/2504-177-0x0000000000000000-mapping.dmp

Download
memory/2584-142-0x0000000000000000-mapping.dmp

Download
memory/2712-170-0x0000000000000000-mapping.dmp

Download
memory/2840-141-0x0000000000000000-mapping.dmp

Download
memory/3064-134-0x0000000000000000-mapping.dmp

Download
memory/3084-162-0x0000000000000000-mapping.dmp

Download
memory/3256-147-0x0000000000000000-mapping.dmp

Download
memory/3292-160-0x0000000000000000-mapping.dmp

Download
memory/3772-143-0x0000000000000000-mapping.dmp

Download
memory/3848-135-0x0000000000000000-mapping.dmp

Download
memory/4012-174-0x0000000000000000-mapping.dmp

Download
memory/4336-154-0x0000000000000000-mapping.dmp

Download
memory/4340-132-0x0000000000000000-mapping.dmp

Download
memory/4352-152-0x0000000000000000-mapping.dmp

Download
memory/4352-176-0x0000000000000000-mapping.dmp

Download
memory/4408-140-0x0000000000000000-mapping.dmp

Download
memory/4624-172-0x0000000000000000-mapping.dmp

Download
memory/4844-133-0x0000000000000000-mapping.dmp

Download
memory/4900-171-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads