e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe
Size 944KB
Sample221011-bglsbsgffp
SHA256 e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246
MD5 64468dbe23a7123cde72439dec449905
SHA1 c3a80ef2c3472a45d8e810adf29f97a0bbe02ccb
SHA512 656f9f6f772a6389d77f403ff48f96a3969db9da7afc99b1310e3bba23c309477c2803b593c5580ac27dbe848757bf67f7d09d67abe2cf1c1607e0beefad915e
SSDEEP 12288:zYn23qEKOen23qEK9IWqBcVslsfHL6sVRVo7YNQ61F85ZwKd89BcF7AiDHgn4H6j:zYlhsU7vWwQOyEvOPDgsaknv4
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0d81ea64-2483-4402-96fc-7fcbd5d2efc3.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221011030929.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
1492	msedge.exe
1492	msedge.exe
688	msedge.exe
688	msedge.exe
5464	identity_helper.exe
5464	identity_helper.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2292	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2292	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
688	msedge.exe
688	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4216	e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 2248	4216	e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe	81
PID 4216 wrote to memory of 2248	4216	e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe	81
PID 4216 wrote to memory of 688	4216	e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe	82
PID 4216 wrote to memory of 688	4216	e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe	82
PID 688 wrote to memory of 2184	688	msedge.exe	84
PID 688 wrote to memory of 2184	688	msedge.exe	84
PID 2248 wrote to memory of 4980	2248	msedge.exe	83
PID 2248 wrote to memory of 4980	2248	msedge.exe	83
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 688 wrote to memory of 4600	688	msedge.exe	89
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88
PID 2248 wrote to memory of 2596	2248	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe
"C:\Users\Admin\AppData\Local\Temp\e37057525d97ca0b2387be41eced03a6c61dfd05d3dcc1a4d774c5692d9f3246.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://b2forum.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff86dea46f8,0x7ff86dea4708,0x7ff86dea4718
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3446376434535601230,16293839809878137458,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3446376434535601230,16293839809878137458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rumpehack.blogspot.com/
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff86dea46f8,0x7ff86dea4708,0x7ff86dea4718
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3432 /prefetch:8
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5472 /prefetch:8
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3952 /prefetch:8
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
    3⤵
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7608 /prefetch:8
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x204,0x20c,0x100,0x22c,0x7ff6b3955460,0x7ff6b3955470,0x7ff6b3955480
      4⤵
      PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7608 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1696 /prefetch:8
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6428 /prefetch:8
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8075701446415829527,9302967210673994667,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3508

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x3f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Size 471B
SHA256 e88ccb72267b1fe0b41b0617b435f658678ff9a57000a907892ff14b86675b70
MD5 138cc6fe8cc5059354cbeaf02ebe21d9
SHA1 25605e714e7f3aaa8888bdc5fed6b653b2c20610
SHA512 3444e997bbe0430566189464e3e9c1b79ff695fb4f58e865cd7e5fdaf793b030dec88b1d87e9ad491a19ce827137b6f014c12f5cfc18856f800e73e85b118ee3
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Size 471B
SHA256 400efe6cb7c5f8e8f36455aa937923facffd6a5bae44ef9196472d508ddb3234
MD5 11ce930255fdb6f3a61fc62964231a6f
SHA1 5f889e623f419a73cdb8c08c4c03047edff63de2
SHA512 842bc59bc6076c5595fecf2a6a0782f034b8a6fcfa7147dfe8c04b4a4c9b5f17a9d16dcf2b094f67b5e0c7c8902d3d71170f85a17801a97d632fec919ef64da2
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Size 412B
SHA256 fd1bb4c2b98378317252ac7c1dbc1d0dbd6481d93ffcef5c8304335a21ae137d
MD5 61d24cbb6910c8c9e1461f91664b039b
SHA1 d28900773c3c3fcafa4f47ce87f034379402d250
SHA512 cd796e214e84356e3bcc8546777cd5331121ed1e7113e9fc468be9e449aab84c8a5e57d656d19b7a3341661e42abb605f2725317793388febe61b04058a6851a
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Size 416B
SHA256 c6efd5f686be8fc4fbc8647c485a5ff412d1575189033c957683289522537775
MD5 25040604e60a50d4feedd070982f7f24
SHA1 29a0bb7e3298049b33045eb954efa17838b255ff
SHA512 ea877818fea27d3524af910fd5c3cfeb70e8b675512f5477b7415b189364dde2b727497dc0cdcf0d552b248263d8c8514b0175db8499e3d124cdd2044e87881e
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Size 416B
SHA256 c6efd5f686be8fc4fbc8647c485a5ff412d1575189033c957683289522537775
MD5 25040604e60a50d4feedd070982f7f24
SHA1 29a0bb7e3298049b33045eb954efa17838b255ff
SHA512 ea877818fea27d3524af910fd5c3cfeb70e8b675512f5477b7415b189364dde2b727497dc0cdcf0d552b248263d8c8514b0175db8499e3d124cdd2044e87881e
MD5 SHA1 SHA512

Submit Download

80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Size 416B
SHA256 c6efd5f686be8fc4fbc8647c485a5ff412d1575189033c957683289522537775
MD5 25040604e60a50d4feedd070982f7f24
SHA1 29a0bb7e3298049b33045eb954efa17838b255ff
SHA512 ea877818fea27d3524af910fd5c3cfeb70e8b675512f5477b7415b189364dde2b727497dc0cdcf0d552b248263d8c8514b0175db8499e3d124cdd2044e87881e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
MD5 e1661723f09a6aed8290c3f836ef2c2b
SHA1 55e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA512 dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
MD5 7b3f352bbc8046d1d5d84c5bb693e2e5
SHA1 e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA512 c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 a9e0caf92279dc0bd673400584d9f608132b9aa4db5d9ab022f5fa17284a3497
MD5 0d0ff6a6b5f60b7524eb45d31192c4c1
SHA1 cd14caacd7ef28d47d0b9a78498d167922641463
SHA512 23b62eba6cbd65bdb2498ecbdd4932d0638723fe0b01aaad58fec33b5d8a0569c2280b1f36513d6ec23bc759424c297294b2d4d289a678b885f5e07c87bc6c76
MD5 SHA1 SHA512

Submit Download

edgeSettings

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings
Size 81B
SHA256 e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00
MD5 f222079e71469c4d129b335b7c91355e
SHA1 0056c3003874efef229a5875742559c8c59887dc
SHA512 e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75
MD5 SHA1 SHA512

Submit Download

edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
Size 126KB
SHA256 2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
MD5 6698422bea0359f6d385a4d059c47301
SHA1 b1107d1f8cc1ef600531ed87cea1c41b7be474f6
SHA512 d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d
SSDEEP 1536:+lIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:beWGP7Eh
MD5 SHA1 SHA512 SSDEEP

Submit Download

synchronousLookupUris

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris
Size 40B
SHA256 7534f1ebf2c1227d636e02a1e53298c967b90f920e984e8717782f819d3b9d68
MD5 92b36a788057b3b685c3b963f44b8fcd
SHA1 dbbdd066f02fbfd69200e12c4fde5a62bd154483
SHA512 bd82a106a45f0ce9b7aea1a42eff82f486d944e645b183f437caf155d0fb1808de3ef7440957da16cda542d7916759c251fdec23ef15c157745504bd5ddf66bd
MD5 SHA1 SHA512

Submit Download

synchronousLookupUris_638010436415218564

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638010436415218564
Size 5KB
SHA256 857c65cc1a4e7012cada9e47b6b314e78c03fd8bda8377287272e7bd6f0fca39
MD5 557b1b74f6c630bf41ffdcd1284c980c
SHA1 23f64e08960e68cc90f162f63c327bcec878e1b0
SHA512 41b5b6cf805ebe040adc66279ebffef416d080e7c44dab5477f5bab2eb8e87380040deb8ec277edad6caf89159a47f0e774cb5936db5537670ebc1414fe41156
SSDEEP 96:xT3ivSHXI29TORtnIJsP0FI3UDh0iW9bKuSTp7J/kcZ7FWfW5:xT4KKR6XOEDu5mugpk8b
MD5 SHA1 SHA512 SSDEEP

Submit Download