8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5

Analysis

max time kernel
165s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe
Size

270KB
MD5

814f613cd4218ffc22135b2c6757b8eb
SHA1

1200429fd2bbfab35cf71e897967023a3ce2a170
SHA256

8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5
SHA512

99bdd15e8b453b19f19e5392bcc4a3c1ba4aae8923d5bd6c3933951bd6484551767f7b80e6a093c22a8446e177fddcedf4f60c02bccc1579f5306455cbef21aa
SSDEEP

6144:zke3DYBIURsh9rQhdGO/NcsxjUYQizpA+ca7QrPooquZb0UP7ys:zZdUQ9rQhzBpTTdZ7Qroo7Zb9Gs

Score

8^/10

microsoft persistence phishing upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4216-134-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4216-137-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4216-143-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6e09cf82-b70b-40ee-b382-badcaeeff3cf.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221021033005.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
3756	msedge.exe
3756	msedge.exe
4900	msedge.exe
4900	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 996	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	81
PID 4216 wrote to memory of 996	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	81
PID 4216 wrote to memory of 996	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	81
PID 996 wrote to memory of 5076	996	cmd.exe	85
PID 996 wrote to memory of 5076	996	cmd.exe	85
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 4216 wrote to memory of 2852	4216	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	87
PID 5076 wrote to memory of 4440	5076	msedge.exe	88
PID 5076 wrote to memory of 4440	5076	msedge.exe	88
PID 2852 wrote to memory of 4900	2852	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	89
PID 2852 wrote to memory of 4900	2852	8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe	89
PID 4900 wrote to memory of 2668	4900	msedge.exe	90
PID 4900 wrote to memory of 2668	4900	msedge.exe	90
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 4776	4900	msedge.exe	93
PID 4900 wrote to memory of 3756	4900	msedge.exe	94
PID 4900 wrote to memory of 3756	4900	msedge.exe	94
PID 5076 wrote to memory of 4460	5076	msedge.exe	95
PID 5076 wrote to memory of 4460	5076	msedge.exe	95
PID 5076 wrote to memory of 4460	5076	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe
"C:\Users\Admin\AppData\Local\Temp\8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\batline.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.com/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8161e46f8,0x7ff8161e4708,0x7ff8161e4718
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14925531061051078198,5425915519013798250,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14925531061051078198,5425915519013798250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4580
- C:\Users\Admin\AppData\Local\Temp\8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe
  C:\Users\Admin\AppData\Local\Temp\8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8161e46f8,0x7ff8161e4708,0x7ff8161e4718
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5284 /prefetch:8
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6072e5460,0x7ff6072e5470,0x7ff6072e5480
        5⤵
        
        PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,1956836068602693724,2503506556855243546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7164 /prefetch:8
      4⤵
      PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8d1042fdf6b29e55a91de164ff0644faa7160d0c4894b32722b146977b2eeed5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8161e46f8,0x7ff8161e4708,0x7ff8161e4718
      4⤵
      PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
7273d2930f2bfd75fd0b30c1161e3368

SHA1
e3fdac8001c01ad8bc341d85157b975dd191242e

SHA256
828ae145e65a50f2edd94772b03047d901f821cfb7d05bf5fd4a554925f3db65

SHA512
d8b6d61bf8df4dc008606208f35aa46fb1e444216a2e5c27908f721f0fca2f2d5a8df59317ecca95d8f2b33d347a8b03883f910b649c8f14cf68b6d3252407b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
471B

MD5
80a0b5026385c3e3df582df9fc8fec9b

SHA1
fb2dbcb443777c8f3a649b3662e3a1e518f63616

SHA256
7ba78f8c7a24dbe5e7e4b1be898c14e872a3bef211f4700da3671818d1670b50

SHA512
b4945af394a04f4b0d9d9c65b39da704605438fa7fe6728b2a2e1f9f7a5712e358858512b2be6787f373bf80f9991ff2849c8d3a03ac28956efe7e7147df0a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
442B

MD5
4b2a1849d39338a8fed3fb91d24be672

SHA1
0c4b885c58ed819dc75fe80b2a2f1b6107a3adb2

SHA256
688573fce4c664a2a9c306bbdfaf04308a40ba205325f24f271756b7c278d6c0

SHA512
6013f7ef066f6ee6e9b023ea891d3296a483c7c4544e62a8f49e26c13a74643db4b09dc3cc8e75e9d71bccc4d2a79957b57bf8d3001d21fb86d5ca40d4dc48cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE

Filesize
446B

MD5
de0c2cf312ebee4a384ed59e7bd7984a

SHA1
e2f427a6195851df15a18b3bfe25c49035a4c9ae

SHA256
caed2390821eb55e50ec23582c426d35c418458a9c16ab653827c4fb796d4bfd

SHA512
9ca3e7377c9214d797c371c745a242e15ee9302e8f81273935dc495e0dc68646f61fa76e86fcf5caa643a6ce372969e1b454f8b49b84b0f9b78e3699bcfa6ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
1918118700259beaedf769115395125a

SHA1
7992f56427ef609fc2a2e59f9ccb1387559e700f

SHA256
7c9295fdd8a842503513d115fd09158cea75d9774ad4e12db1385f9759e0fe02

SHA512
8304152a97b51eb1225ea37d6a40f7e5bee39b1c3c3fa066ee35b863442d482b860d986cf1d5ee9b3829bd9d096ced2f07ea775e6ae2fd3ee3c989fcf9e72ca0

Download Submit
C:\Users\Admin\AppData\Local\Temp\batline.bat

Filesize
27B

MD5
c11d8e49f0a1602a8bac3d27b303ff51

SHA1
889e5dd51fe4dbd9a05694560b99bd6c63445bf6

SHA256
699b49a3668fb324165ac01799134df194b4630723541f57c482d46ac400781a

SHA512
0161af8c503941abfef2856fe10a91ce279a23ad41852ec069130eede892fd020415f592ed50d4637e5051585591e1c701fea99311412906d6759444dd3a1793

Download Submit
memory/2852-141-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2852-140-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2852-139-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4216-137-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4216-143-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4216-134-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download