1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1

Analysis

max time kernel
171s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Size

385KB
MD5

82917b114d69f543c50e240bab277f50
SHA1

05df43cc3f5b674c586fbb58c6d0440be80f6c75
SHA256

1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1
SHA512

57ea9528d87c626fc3a608f7dc026a6b7f888a787060c188dc16ed5ac46894d9d3830fd86042da7b90d015fcb98f39e166feccb9874f5f1befcdd290c1476dfb
SSDEEP

6144:ihEZTkcx3Udi053oLCi9Aug6SaTQgVZPDV5cFZvCgg4dWY0+bL:fZoWMLNyxTJVZPfcFZrgWbB

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\SysWOW64\COMCTL32.OCX	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
File opened for modification	\??\c:\Windows\SysWOW64\COMDLG32.OCX	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSINET.OCX	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
File opened for modification	C:\Windows\SysWOW64\buatalvi.dll	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
File opened for modification	C:\Windows\SysWOW64\Krisna Yana Javista.dll	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221020064608.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0bb54dc2-7e5c-4423-82d4-c26e4f3ffc0f.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Programmable	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSINET.OCX, 1"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\ = "Microsoft Common Dialog Control, version 6.0 (SP6)"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA4-3FE5-101B-A3C9-08002B2F49FB}\ = "Common Dialog Color Property Page Object"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\TypeLib\Version = "1.2"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSINET.OCX"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog\ = "Microsoft Common Dialog Control, version 6.0 (SP6)"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\ = "ICommonDialogEvents"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog.1\ = "Microsoft Common Dialog Control, version 6.0 (SP6)"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog.1\CLSID\ = "{F9043C85-F6F2-101A-A3C9-08002B2F49FB}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Version	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Control	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\VersionIndependentProgID\ = "MSComDlg.CommonDialog"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\ = "Microsoft Common Dialog Control 6.0 (SP6)"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ = "Microsoft Internet Transfer Control 6.0 (SP6)"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog.1\CLSID	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\TypeLib	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMDLG32.OCX"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID\ = "InetCtls.Inet.1"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32\ThreadingModel = "Apartment"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\TypeLib\Version = "1.2"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\TypeLib	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\TypeLib\ = "{F9043C88-F6F2-101A-A3C9-08002B2F49FB}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMDLG32.OCX"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ThreadingModel = "Apartment"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\ = "0"	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComDlg.CommonDialog\CLSID	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3444	4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe	79
PID 4268 wrote to memory of 3444	4268	1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe	79
PID 3444 wrote to memory of 3324	3444	msedge.exe	80
PID 3444 wrote to memory of 3324	3444	msedge.exe	80
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3176	3444	msedge.exe	83
PID 3444 wrote to memory of 3184	3444	msedge.exe	84
PID 3444 wrote to memory of 3184	3444	msedge.exe	84
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87
PID 3444 wrote to memory of 8	3444	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe
"C:\Users\Admin\AppData\Local\Temp\1e01831b5d65e0d68dd805efa7b9e99c8879b01b5becd887536afc0dea3a3ed1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pekalongan-kommunity.com/
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa070a46f8,0x7ffa070a4708,0x7ffa070a4718
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3272 /prefetch:8
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5768 /prefetch:8
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff6b38c5460,0x7ff6b38c5470,0x7ff6b38c5480
      4⤵
      PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6580 /prefetch:8
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6244 /prefetch:2
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,15904525991868938217,11868427279083033830,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1d098255a63d9b3c0f9d02a30a9c2884

SHA1
2d108db0eaea286147c6dfd078063d3b6b2a9cfb

SHA256
3d14d5299b60dd090c9d4ec92f24e1bb1d2059e4495398edd83ca0b3d2e142f3

SHA512
e3e6da4f0e3623de908c825b045ce7021584f76a0f27551e19cd757f4b5f85f493ea7ea41f3969672e44bdcefb8ff0cd60ce7305daa18021110f8e4fa730ce2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
251400f6ca73bfc28fb082597d2eea3b

SHA1
b350f2d418d2f21891ccd98635b34e697be48236

SHA256
9853eb75adbd3b089f054426f7cd1c69558691933fa90f6076a4081309114d61

SHA512
682ddcedf0d5762c39c337ad1cb7662c9b6264586bcb58accc34e0813504bdc78e581f871cd1f328119d66d89260b5524f078f3d11ce16ce5c5129b21aa4b76d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
978f5505523c8f31fc0f9640796512b5

SHA1
63ccb478baa27ca3cea0c18db712dd0cd7afc270

SHA256
ab3b30852bd9e847202a0f3380d854053975d4acbd76f81cb3c58df3e18677ac

SHA512
b34e9a8bc5f7694d74028504060ca73011743e0629681430b425e639ae159d57c304cf539104cef60842ef26921a36612133a312c4f53193eafadca3ec3b8556

Download Submit
C:\Windows\SysWOW64\COMDLG32.OCX

Filesize
149KB

MD5
ab412429f1e5fb9708a8cdea07479099

SHA1
eb49323be4384a0e7e36053f186b305636e82887

SHA256
e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240

SHA512
f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9

Download Submit
C:\Windows\SysWOW64\COMDLG32.OCX

Filesize
149KB

MD5
ab412429f1e5fb9708a8cdea07479099

SHA1
eb49323be4384a0e7e36053f186b305636e82887

SHA256
e32d8bbe8e6985726742b496520fa47827f3b428648fa1bc34ecffdd9bdac240

SHA512
f3348dbc3b05d14482250d7c399c00533598973f8e9168b4082ee5cbb81089dfaefcfda5a6a3c9f05b4445d655051b7a5170c57ee32d7a783dc35a75fee41aa9

Download Submit
C:\Windows\SysWOW64\MSINET.OCX

Filesize
129KB

MD5
90a39346e9b67f132ef133725c487ff6

SHA1
9cd22933f628465c863bed7895d99395acaa5d2a

SHA256
e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2

SHA512
0337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf

Download Submit
C:\Windows\SysWOW64\MSINET.OCX

Filesize
129KB

MD5
90a39346e9b67f132ef133725c487ff6

SHA1
9cd22933f628465c863bed7895d99395acaa5d2a

SHA256
e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2

SHA512
0337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf

Download Submit
memory/4268-133-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/4268-132-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/4268-173-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download