5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe
Size

292KB
MD5

0cce48f3e156333bf22e3305e4592de0
SHA1

34f80185ccc4e98c70d2ce171421137e5eef9599
SHA256

5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de
SHA512

081942feef4a7cfba4a1f8788afd5641ea08ee8c61157f1725e6a21fe86c953487c7ca6fcb037a838524c0a3a4fa336de611b10e0d3fb53b2e4503d3557c7370
SSDEEP

6144:spFXJCEGWhXGwOIY9xzR9kCN5tfJCecPc3NeFc:aJCEGWGuYrN5tf8eck3wF

Score

8^/10

microsoft persistence phishing

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4732	win76.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runAPI24 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\runAPI89.exe\""	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\adc4273e-5751-408c-a8cb-6fa6496b0731.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221108043836.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
4364	msedge.exe
4364	msedge.exe
5104	msedge.exe
5104	msedge.exe
4928	identity_helper.exe
4928	identity_helper.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4776 wrote to memory of 4732	4776	5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe	80
PID 4732 wrote to memory of 5104	4732	win76.exe	81
PID 4732 wrote to memory of 5104	4732	win76.exe	81
PID 5104 wrote to memory of 2032	5104	msedge.exe	82
PID 5104 wrote to memory of 2032	5104	msedge.exe	82
PID 4732 wrote to memory of 1912	4732	win76.exe	83
PID 4732 wrote to memory of 1912	4732	win76.exe	83
PID 1912 wrote to memory of 1848	1912	msedge.exe	84
PID 1912 wrote to memory of 1848	1912	msedge.exe	84
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 5104 wrote to memory of 3640	5104	msedge.exe	88
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87
PID 1912 wrote to memory of 424	1912	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe
"C:\Users\Admin\AppData\Local\Temp\5dd2390222c5e0b3476122fb9305932faa33e311a6ab062218c55be911a0f6de.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\win76.exe
  C:\Users\Admin\AppData\Local\Temp\win76.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=win76.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b48146f8,0x7ff8b4814708,0x7ff8b4814718
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1472 /prefetch:8
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5588 /prefetch:8
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5900 /prefetch:8
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6ebe15460,0x7ff6ebe15470,0x7ff6ebe15480
        5⤵
        
        PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2381310233561713662,5195226640197188940,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2664 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=win76.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8b48146f8,0x7ff8b4814708,0x7ff8b4814718
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5719639333868162538,6649272115040212699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5719639333868162538,6649272115040212699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
34ba8c02ada77e8897e23b1f9cc4608b

SHA1
c362ef4d53c200ca75ca620ca4492c15f270eef9

SHA256
f3cc940361b3e7e437b946724f295e2c7d5979185a5cb5c2e951df397c8ce960

SHA512
13d1e3ef6be0ecfa0b61cfac4c178dd5039317858330bc8e864beac6d65bb991cf0a2461e8a57b665ad81bc7349396bead5f71ff90e2546907fbf6449f9cb06d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
442B

MD5
706860b923cad6c3556ee1c0c4e0c2b4

SHA1
9eaea1f67f39be7a1b3298889302bf5b754e7ac4

SHA256
c4b2a486b955b4babbcabaf281ccd6b145f0453652829608790150b96b5459c2

SHA512
6265c04e4b134690d52966187e3fdf7044db78add333ab6051f3fa357a50f33f5a7218d8b7ae7edaa4bcd0559a76703426e5425ca61a138173dd5cabfd9c75ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
af05481b81fdeb6c34b41fa28542b8e1

SHA1
30982103d4ad165cda1b492f96da553b0d5a8663

SHA256
61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

SHA512
6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
0b21c4676a96afed1ed7533248808f5d

SHA1
e899b8d695b62a06f5f3b777d34a01cf6bcc0df5

SHA256
1db418c88787920aa9cb473ba8e42a17770acc2450f4f9b4725b6913280c621d

SHA512
d063cdd40eb9e075230afd0fa2db5449951a1a2da1eb2af4b2f9045a264dc95a20d50677687be0f947f2046cd18c716b0139dbdeb85bc56f38288ac6513cbfa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5c17d19bb479fbf07573eb881eba0423

SHA1
f19a5c6b4c5f40258c23328cb0c24cbad52c1389

SHA256
c958d1d29f27c468b8507e00729cbc6979204dc99344e655cfff1ff033c7f56d

SHA512
32c764058dd96280477db80f5a4275efe70c0c2b1f881cb48ca4299d6e17a0074ee8471d3d8c6bf9998675a890027ec17ad39079af50367be85e6d27bf2f2c91

Download Submit
C:\Users\Admin\AppData\Local\Temp\win76.exe

Filesize
4KB

MD5
5e5ecae8b08152c885904cde71c50dad

SHA1
727f24d102ab29be690c783ddc149b3a39430fb6

SHA256
b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541

SHA512
dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\win76.exe

Filesize
4KB

MD5
5e5ecae8b08152c885904cde71c50dad

SHA1
727f24d102ab29be690c783ddc149b3a39430fb6

SHA256
b3550952a2474802ae5f2d2d7e75987ccd7ca23baa8ba015c3eaa6fd04b55541

SHA512
dd6287a8471aa575abbcf46300ac64a170c0cb19052d779c7bc0899149c6114a4e42520756dae1598e18458d94522d6c7701a7bc3a37067ac2a1616dbbf8e5ea

Download Submit
memory/424-150-0x0000000000000000-mapping.dmp

Download
memory/1848-141-0x0000000000000000-mapping.dmp

Download
memory/1912-140-0x0000000000000000-mapping.dmp

Download
memory/1944-172-0x0000000000000000-mapping.dmp

Download
memory/2032-139-0x0000000000000000-mapping.dmp

Download
memory/2360-176-0x0000000000000000-mapping.dmp

Download
memory/2772-164-0x0000000000000000-mapping.dmp

Download
memory/3288-178-0x0000000000000000-mapping.dmp

Download
memory/3368-151-0x0000000000000000-mapping.dmp

Download
memory/3408-174-0x0000000000000000-mapping.dmp

Download
memory/3640-149-0x0000000000000000-mapping.dmp

Download
memory/4288-170-0x0000000000000000-mapping.dmp

Download
memory/4364-152-0x0000000000000000-mapping.dmp

Download
memory/4368-156-0x0000000000000000-mapping.dmp

Download
memory/4376-162-0x0000000000000000-mapping.dmp

Download
memory/4724-181-0x0000000000000000-mapping.dmp

Download
memory/4732-134-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4732-133-0x0000000000000000-mapping.dmp

Download
memory/4756-168-0x0000000000000000-mapping.dmp

Download
memory/4776-137-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4776-132-0x0000000074B90000-0x0000000075141000-memory.dmp

Filesize
5.7MB

Download
memory/4780-183-0x0000000000000000-mapping.dmp

Download
memory/4908-166-0x0000000000000000-mapping.dmp

Download
memory/4920-182-0x0000000000000000-mapping.dmp

Download
memory/4928-180-0x0000000000000000-mapping.dmp

Download
memory/5104-138-0x0000000000000000-mapping.dmp

Download