joker | 4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
Size

840KB
MD5

827f5fc064da1deb879a11f3fcfaa440
SHA1

6b48994ac27161d4438b5be21b8dd3bc9123dfc2
SHA256

4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3
SHA512

0f310226b43d31922cbcb9807feadd2b2841fd51263a4ab0b6ff39cc3a3454ad9c4216111092c74be578ae18ee0e9d68ce9abb9b271a51d4546c437069897da1
SSDEEP

12288:AvIuVHsBSvMgC4PV/vqUsaJF4U03wdWTVia/SMZoS5Xv3+Rt:AvxVuSvMv49/vPsFwtMFfE

Score

10^/10

joker infostealer persistence trojan upx

Malware Config

Extracted

Family

joker

http://aqmidpic.oss-cn-shanghai.aliyuncs.com

Signatures

joker
Joker is an Android malware that targets billing and SMS fraud.
infostealer trojan joker

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4696-132-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-134-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-135-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-136-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-137-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-139-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-141-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-143-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-145-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-148-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-150-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-152-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-154-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-156-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-158-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-160-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-162-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-164-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-166-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-168-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-170-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-172-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-174-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-176-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-178-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3836-180-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3836-181-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3836-182-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3836-185-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3836-186-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3836-187-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4696-190-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4696-209-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221031071659.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ccf446d2-91dd-4c25-add3-87c214e666ff.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1832	4696	WerFault.exe	81
112	4696	WerFault.exe	81

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\yy.com	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com	calc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\yy.com\NumberOfSubdomains = "1"	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
4620	msedge.exe
4620	msedge.exe
4252	msedge.exe
4252	msedge.exe
2304	identity_helper.exe
2304	identity_helper.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
3836	calc.exe
3836	calc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 3836	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	82
PID 4696 wrote to memory of 4132	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	83
PID 4696 wrote to memory of 4132	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	83
PID 4696 wrote to memory of 4132	4696	4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe	83
PID 4132 wrote to memory of 4252	4132	rundll32.exe	84
PID 4132 wrote to memory of 4252	4132	rundll32.exe	84
PID 4252 wrote to memory of 3496	4252	msedge.exe	85
PID 4252 wrote to memory of 3496	4252	msedge.exe	85
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 2560	4252	msedge.exe	88
PID 4252 wrote to memory of 4620	4252	msedge.exe	89
PID 4252 wrote to memory of 4620	4252	msedge.exe	89
PID 4252 wrote to memory of 4568	4252	msedge.exe	91
PID 4252 wrote to memory of 4568	4252	msedge.exe	91
PID 4252 wrote to memory of 4568	4252	msedge.exe	91
PID 4252 wrote to memory of 4568	4252	msedge.exe	91
PID 4252 wrote to memory of 4568	4252	msedge.exe	91
PID 4252 wrote to memory of 4568	4252	msedge.exe	91
PID 4252 wrote to memory of 4568	4252	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe
"C:\Users\Admin\AppData\Local\Temp\4e1b4ed26e00cf742ca55ecc47a9b790c964014a352ef676939ec30a845aeff3.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\calc.exe
  calc.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3836
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" url.dll,FileProtocolHandler http://nz38.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://nz38.com/
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8aaeb46f8,0x7ff8aaeb4708,0x7ff8aaeb4718
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3320 /prefetch:8
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4988 /prefetch:8
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5736 /prefetch:8
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x204,0x22c,0x7ff7228f5460,0x7ff7228f5470,0x7ff7228f5480
        5⤵
        
        PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5828 /prefetch:8
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6473763926642366535,8269540817067180236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 3068
  2⤵
  - Program crash
  PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 3068
  2⤵
  - Program crash
  PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4696 -ip 4696
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4696 -ip 4696
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\48VMALJK\WINGEL2X.htm

Filesize
178B

MD5
cd2e0e43980a00fb6a2742d3afd803b8

SHA1
81ffbd1712afe8cdf138b570c0fc9934742c33c1

SHA256
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

SHA512
0344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DUHIRKGY\P1S7QCDM.htm

Filesize
178B

MD5
cd2e0e43980a00fb6a2742d3afd803b8

SHA1
81ffbd1712afe8cdf138b570c0fc9934742c33c1

SHA256
bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d

SHA512
0344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\U4NN81K1.htm

Filesize
357KB

MD5
c8e1905c5db0c25b0aa016b42124c9bb

SHA1
1f262c8bddf4be3c9240692eee3c19f87df0d179

SHA256
9b0bfd96062180e02242670d3c26a193475755737d84771067b618e08dc39cef

SHA512
8df35b8e51cd23ebb685c36ae07d398ddbe44cae25b1b8218bdb52deebf233b5bf00ce89c6c797bee83238c9f6a70363e41e96cce15f73165d499b325fbab9d9

Download Submit
memory/3836-182-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3836-188-0x000000000040E000-0x0000000000415000-memory.dmp

Filesize
28KB

Download
memory/3836-180-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3836-185-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3836-186-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3836-187-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3836-181-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3836-189-0x0000000000401000-0x000000000040E000-memory.dmp

Filesize
52KB

Download
memory/4696-178-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-148-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-156-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-176-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-174-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-172-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-170-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-190-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-168-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-166-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-154-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-152-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-164-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-150-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-162-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-132-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-145-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-143-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-134-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-141-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-160-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-209-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-135-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-139-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-136-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-137-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4696-158-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download