0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7

Analysis

max time kernel
165s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe
Size

448KB
MD5

a29c7c2d94afcf5aeb5b65ddbd78fbb0
SHA1

8e2edfc513e47f00c874abda5c5cccae79310cc1
SHA256

0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7
SHA512

8b1b161818527b3ed3cf019f6669ac1bfc1759ef8b8250262fa2332372ac5899d50e2ae6c5aa96cd02dfef87fd46caede6890d00dc0add9a0d2b8f6e8726b48a
SSDEEP

12288:cgDM2i8NvDqqobjPxiEmgyNt8iseQGbg56hmsPqtPjhp:hDG8NvVobzxiEmgyj8eJbgghmsPi9p

Score

8^/10

microsoft persistence phishing upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3784-133-0x0000000000400000-0x0000000000448000-memory.dmp	upx
behavioral2/memory/3784-139-0x0000000000400000-0x0000000000448000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3784 set thread context of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 2488 set thread context of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\70a8cb17-56c1-4900-9fed-530171026e29.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221030182818.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
2272	msedge.exe
2272	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe
2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 3784 wrote to memory of 2488	3784	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	81
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 2488 wrote to memory of 748	2488	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	82
PID 748 wrote to memory of 1728	748	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	85
PID 748 wrote to memory of 1728	748	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	85
PID 1728 wrote to memory of 3768	1728	msedge.exe	86
PID 1728 wrote to memory of 3768	1728	msedge.exe	86
PID 748 wrote to memory of 176	748	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	89
PID 748 wrote to memory of 176	748	0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe	89
PID 176 wrote to memory of 2944	176	msedge.exe	90
PID 176 wrote to memory of 2944	176	msedge.exe	90
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91
PID 1728 wrote to memory of 3404	1728	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe
"C:\Users\Admin\AppData\Local\Temp\0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe
  C:\Users\Admin\AppData\Local\Temp\0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe
    "C:\Users\Admin\AppData\Local\Temp\0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa039b46f8,0x7ffa039b4708,0x7ffa039b4718
        5⤵
        
        PID:3768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
        5⤵
        
        PID:3404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
        5⤵
        
        PID:1040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
        5⤵
        
        PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
        5⤵
        
        PID:1652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
        5⤵
        
        PID:3948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5164 /prefetch:8
        5⤵
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
        5⤵
        
        PID:2860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
        5⤵
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6488 /prefetch:8
        5⤵
        
        PID:4696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
        5⤵
        
        PID:3208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:5096
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7957e5460,0x7ff7957e5470,0x7ff7957e5480
        6⤵
        
        PID:4808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
        5⤵
        
        PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1300 /prefetch:8
        5⤵
        
        PID:1212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12225771795275214399,3592683574736126965,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3932 /prefetch:2
        5⤵
        
        PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0c5eb9087bda190cd35c96cb53b90037cf36216daf6a8f10cd382bc4cf1ac5d7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
      4⤵
      Suspicious use of WriteProcessMemory
      PID:176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa039b46f8,0x7ffa039b4708,0x7ffa039b4718
        5⤵
        
        PID:2944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,16134418833623279454,2729683072900602081,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
        5⤵
        
        PID:1520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,16134418833623279454,2729683072900602081,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
e04fd2d511646b21f1cdda008c138e44

SHA1
e68a2d1de28c4a4ba27255555b17710a9ceb5565

SHA256
0097baed82346518eafaeb92e6f667ead19f98ad096699f1eb6b539ca281f00f

SHA512
4486b95d82ad15a8162a3004daa59c4545c87d77b3c8858683c008b9eedde3844ce32e23a2aa358d53ad96d13c77fa9d95413143b1fb1ceec2e56decdc6ea439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
442B

MD5
afd648fee40d4fb46919861a33be3f20

SHA1
966b0858e16a87617a9ada345768cb97420c297e

SHA256
0f5a6773f93f1675a261a1383c4d1049b52dbf66528c3e2ab6272da9d0d0df2b

SHA512
9c71bd0ac1c29044a1e03c7d7b02973bfc61d2cf17284b8b35bb4545b360fa952454d097df11cc2848a4c1e2adc548a43736ee5d89f7afbaa337179eb83fbb38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
818f6adf26d59c6124d9c64c614791d6

SHA1
4e4d4cd8abd6569ba17d61ef40050ed74bb17240

SHA256
3805a6abe0d8b2d928fa4108f2dcc2b62050dec821c4da5555132812ed80098e

SHA512
6248318b8fac57fbc65886a7c439ef57c17dd0d0cb39105082c37fcdb0ae231b7ca699c43d3194226cfd96a8563a86f14623a6bf066f3d190432b8c6cb0a3356

Download Submit
memory/748-144-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2488-137-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2488-142-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2488-145-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3784-133-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3784-139-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download