Analysis
-
max time kernel
159s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2022 12:39
Static task
static1
Behavioral task
behavioral1
Sample
6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe
Resource
win10v2004-20220812-en
General
-
Target
6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe
-
Size
1.3MB
-
MD5
9452b43c872f4faee376be781cc806ac
-
SHA1
9c4cd526673d65da48b338254a7026a705e54bee
-
SHA256
6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d
-
SHA512
4a4ef2cc77a4915c76f002050b0c54ca5494d0e972e95c912cc7a59c47a5861069a1b933ba862fc315bd1e185fea66dee04475157d7b16e421d156889c7d751e
-
SSDEEP
24576:Z2cJ+//0wDXIxwbDbNyGYb8hDymv6+zQ6ZbpzN0OUQmCRkRuRD:Z2cJqPLV/F9v65UaOUQmCuRuR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2480 ~~1954363467070492104.tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 26 IoCs
description ioc Process File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\書山有路勤爲徑,學海無涯苦作舟。.txt ~~1954363467070492104.tmp.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7b33ed81-4bc4-4419-b306-ef27ee7bb165.tmp setup.exe File created C:\Program Files\__tmp_rar_sfx_access_check_240560578 ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group ~~1954363467070492104.tmp.exe File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\plugins\vray_BRDFScanned.dll ~~1954363467070492104.tmp.exe File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\www.lx7d.com.txt ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\www.lx7d.com.txt ~~1954363467070492104.tmp.exe File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\書山有路勤爲徑,學海無涯苦作舟。.txt ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221007144034.pma setup.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\cgauth.dll ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\plugins ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\www.lx7d.com.txt ~~1954363467070492104.tmp.exe File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\更多精华资源下载.url ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\書山有路勤爲徑,學海無涯苦作舟。.txt ~~1954363467070492104.tmp.exe File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\cgauth.dll ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension ~~1954363467070492104.tmp.exe File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\www.lx7d.com.txt ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\更多精华资源下载.url ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\plugins\vray_BRDFScanned.dll ~~1954363467070492104.tmp.exe File created C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\更多精华资源下载.url ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\更多精华资源下载.url ~~1954363467070492104.tmp.exe File opened for modification C:\Program Files\Chaos Group\V-Ray\V-Ray for SketchUp\extension\vrayappsdk\bin\書山有路勤爲徑,學海無涯苦作舟。.txt ~~1954363467070492104.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe 4692 msedge.exe 4692 msedge.exe 4328 identity_helper.exe 4328 identity_helper.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe 1824 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeBackupPrivilege 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeRestorePrivilege 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: 33 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeIncBasePriorityPrivilege 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: 33 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeIncBasePriorityPrivilege 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeBackupPrivilege 5012 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeRestorePrivilege 5012 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: 33 5012 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeIncBasePriorityPrivilege 5012 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: 33 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeIncBasePriorityPrivilege 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: 33 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeIncBasePriorityPrivilege 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeBackupPrivilege 2144 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeRestorePrivilege 2144 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: 33 2144 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe Token: SeIncBasePriorityPrivilege 2144 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 724 wrote to memory of 5012 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 82 PID 724 wrote to memory of 5012 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 82 PID 724 wrote to memory of 2480 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 83 PID 724 wrote to memory of 2480 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 83 PID 724 wrote to memory of 2480 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 83 PID 2480 wrote to memory of 4692 2480 ~~1954363467070492104.tmp.exe 84 PID 2480 wrote to memory of 4692 2480 ~~1954363467070492104.tmp.exe 84 PID 4692 wrote to memory of 4548 4692 msedge.exe 86 PID 4692 wrote to memory of 4548 4692 msedge.exe 86 PID 724 wrote to memory of 2144 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 87 PID 724 wrote to memory of 2144 724 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 87 PID 2144 wrote to memory of 4828 2144 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 88 PID 2144 wrote to memory of 4828 2144 6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe 88 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2040 4692 msedge.exe 92 PID 4692 wrote to memory of 2404 4692 msedge.exe 93 PID 4692 wrote to memory of 2404 4692 msedge.exe 93 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95 PID 4692 wrote to memory of 1988 4692 msedge.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe"C:\Users\Admin\AppData\Local\Temp\6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exePECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~1954363467070492104.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exe""#102|SCRIPT"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012
-
-
C:\Users\Admin\AppData\Local\Temp\~~1954363467070492104.tmp.exe"C:\Users\Admin\AppData\Local\Temp\~~1954363467070492104.tmp.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.lx7d.com/forum.php3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee99746f8,0x7ffee9974708,0x7ffee99747184⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:24⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:84⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:14⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:14⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 /prefetch:84⤵PID:824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5752 /prefetch:84⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:14⤵PID:2264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:14⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:84⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
PID:4488 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff6690c5460,0x7ff6690c5470,0x7ff6690c54805⤵PID:4828
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3332 /prefetch:84⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3336 /prefetch:84⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6188 /prefetch:84⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5292 /prefetch:84⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:1824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,15034532795677912845,788016946150659376,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:84⤵PID:4220
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6db62dd8dd030ef514337fb3c7f147c0665efbcc37b1ff97707ed74094a8835d.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~2666149989220573026.cmd"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~2666149989220573026.cmd"3⤵PID:4828
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404B
MD5e4b4a0d5d56314607d88d03671220880
SHA126beff7e954af661c8b8feca5a1438a2ac2646bd
SHA2564baff68e02344c6c47d7ea6dc05c09bd0538295f12e94e8ef036d4484c541d54
SHA5129c3890c2be797279593b7ca1f5908c3fa1e938da6c90437f16b815d9015b94907cd923fcbee74c88ae2d19a73fea11da6d5295d951b387fef5c9483fc9557e0e
-
Filesize
780KB
MD5626903ee8e09561cf1874db9aea14a2a
SHA1bb712ab8f0e3439f6cc8a0ac69529c2317a20bba
SHA256ac0afc4ab33420118d4f4f0f4141c81cf4fab1f39bb0b2b2b9fc831fd7fd07e1
SHA512e9cfd3b1656db3acf90f00777bd105264fcc0f9a4edbb7b630d509255d4a52111e0b79c18e64c2fa72aad8e77aeaa2d173ac407aed968b2c1f202977ed14fc78
-
Filesize
780KB
MD5626903ee8e09561cf1874db9aea14a2a
SHA1bb712ab8f0e3439f6cc8a0ac69529c2317a20bba
SHA256ac0afc4ab33420118d4f4f0f4141c81cf4fab1f39bb0b2b2b9fc831fd7fd07e1
SHA512e9cfd3b1656db3acf90f00777bd105264fcc0f9a4edbb7b630d509255d4a52111e0b79c18e64c2fa72aad8e77aeaa2d173ac407aed968b2c1f202977ed14fc78