Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2022 15:18
Static task
static1
Behavioral task
behavioral1
Sample
4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe
Resource
win10v2004-20221111-en
General
-
Target
4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe
-
Size
740KB
-
MD5
49c503f108a8d690e917ce8937b1fc10
-
SHA1
4fff4209e2bbd21720887f20917e39f0dff617e8
-
SHA256
4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771
-
SHA512
4529a38d498d4a929d92264745b46aae993fc09b5a894f21cc46a02b78de51d04d7889dff1b4611ec7e1f81cd54861b1d7f79ff2f7001dd9aecbfd538dcb8eeb
-
SSDEEP
12288:tSIiCyhy8QhOnE/4JSIiCyhy8QhOnE/4jXLnyLdS:WLYLN3
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exedescription pid process target process PID 1536 set thread context of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1db9cd5f-8464-40e9-b467-eaf7a3c3475a.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221121162020.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3500 msedge.exe 3500 msedge.exe 3212 msedge.exe 3212 msedge.exe 3896 msedge.exe 3896 msedge.exe 4336 identity_helper.exe 4336 identity_helper.exe 376 msedge.exe 376 msedge.exe 376 msedge.exe 376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 3896 msedge.exe 3896 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exepid process 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXEmsedge.exemsedge.exedescription pid process target process PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 1536 wrote to memory of 4476 1536 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE PID 4476 wrote to memory of 4280 4476 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE msedge.exe PID 4476 wrote to memory of 4280 4476 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE msedge.exe PID 4280 wrote to memory of 4256 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 4256 4280 msedge.exe msedge.exe PID 4476 wrote to memory of 3896 4476 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE msedge.exe PID 4476 wrote to memory of 3896 4476 4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE msedge.exe PID 3896 wrote to memory of 3472 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 3472 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 3896 wrote to memory of 4384 3896 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe PID 4280 wrote to memory of 1984 4280 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe"C:\Users\Admin\AppData\Local\Temp\4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE"C:\Users\Admin\AppData\Local\Temp\4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff852fa46f8,0x7ff852fa4708,0x7ff852fa47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,126339689688687250,11825119716377286902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,126339689688687250,11825119716377286902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4c8977c17d7a2022b059cbf04c07aac73b49f3822a760e03f6e9ff83f34f6771.EXE&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff852fa46f8,0x7ff852fa4708,0x7ff852fa47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5528 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5872 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3368 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff7c5ea5460,0x7ff7c5ea5470,0x7ff7c5ea54805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3368 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9283644145957804593,7409403429629190461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5932 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a58a7931227f93b9a54bc982c0d99582
SHA17591b129f025f2003039a81830b9cd5d7043d3e2
SHA256a6751ef5a8d88960e0fc22e205155f766e840d13c46c962166f35e3bf8367ac0
SHA51224eec66ba6b79cebb2b920cdad34f9b68fcc9503a2e4bc718ddf3d39b8f959ee1c7b0e73079b31a0e8acc98960fcedeb7e49f38b8f5036aa21294048f7f1a79b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a58a7931227f93b9a54bc982c0d99582
SHA17591b129f025f2003039a81830b9cd5d7043d3e2
SHA256a6751ef5a8d88960e0fc22e205155f766e840d13c46c962166f35e3bf8367ac0
SHA51224eec66ba6b79cebb2b920cdad34f9b68fcc9503a2e4bc718ddf3d39b8f959ee1c7b0e73079b31a0e8acc98960fcedeb7e49f38b8f5036aa21294048f7f1a79b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a58a7931227f93b9a54bc982c0d99582
SHA17591b129f025f2003039a81830b9cd5d7043d3e2
SHA256a6751ef5a8d88960e0fc22e205155f766e840d13c46c962166f35e3bf8367ac0
SHA51224eec66ba6b79cebb2b920cdad34f9b68fcc9503a2e4bc718ddf3d39b8f959ee1c7b0e73079b31a0e8acc98960fcedeb7e49f38b8f5036aa21294048f7f1a79b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56102471af38b45f30decc8db2f59a8e2
SHA135428c52f58b3a35d5028929b6298d6b95d6bdec
SHA25657e3a5210c5872fc5d56b4111a4d07e512ef54a79128391084c167c101a9d7c4
SHA5121040720fe63680c7a17ced8026e3a2e31e0e73066bd0c3d74e5cd4a19c0e6f23dc30e0a41f62d92c0b9cc9840895ece4b3d36a200816e400feec49e54599b3fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56102471af38b45f30decc8db2f59a8e2
SHA135428c52f58b3a35d5028929b6298d6b95d6bdec
SHA25657e3a5210c5872fc5d56b4111a4d07e512ef54a79128391084c167c101a9d7c4
SHA5121040720fe63680c7a17ced8026e3a2e31e0e73066bd0c3d74e5cd4a19c0e6f23dc30e0a41f62d92c0b9cc9840895ece4b3d36a200816e400feec49e54599b3fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD505575ac904b87b61fec073a4a2e4ed0a
SHA1cfd3735c46970e45b89163bfb4c4e9b114945caa
SHA256b6ac94cebeeafa7c4d46ad9906037b12d6f096ce5bb2072a726a84085a0f11e4
SHA512af553ab70efd59a8040008e76a8322e44d4c130f4ff85732d2d60198963ef719e69b0f949e6bab9029fc7c7f8e2b783ea63f22b1fe7f4a46dc92bb483d84a1b8
-
\??\pipe\LOCAL\crashpad_3896_LHNGNARVIVVSGRTFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4280_JAIFKTDHCDEQOJTRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/376-179-0x0000000000000000-mapping.dmp
-
memory/768-178-0x0000000000000000-mapping.dmp
-
memory/832-151-0x0000000000000000-mapping.dmp
-
memory/912-169-0x0000000000000000-mapping.dmp
-
memory/1108-171-0x0000000000000000-mapping.dmp
-
memory/1500-175-0x0000000000000000-mapping.dmp
-
memory/1984-147-0x0000000000000000-mapping.dmp
-
memory/2868-158-0x0000000000000000-mapping.dmp
-
memory/3040-173-0x0000000000000000-mapping.dmp
-
memory/3204-156-0x0000000000000000-mapping.dmp
-
memory/3212-148-0x0000000000000000-mapping.dmp
-
memory/3472-139-0x0000000000000000-mapping.dmp
-
memory/3500-149-0x0000000000000000-mapping.dmp
-
memory/3712-165-0x0000000000000000-mapping.dmp
-
memory/3820-167-0x0000000000000000-mapping.dmp
-
memory/3896-138-0x0000000000000000-mapping.dmp
-
memory/4256-137-0x0000000000000000-mapping.dmp
-
memory/4280-136-0x0000000000000000-mapping.dmp
-
memory/4308-160-0x0000000000000000-mapping.dmp
-
memory/4336-176-0x0000000000000000-mapping.dmp
-
memory/4384-145-0x0000000000000000-mapping.dmp
-
memory/4476-135-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4476-134-0x0000000000000000-mapping.dmp
-
memory/4936-174-0x0000000000000000-mapping.dmp
-
memory/4976-162-0x0000000000000000-mapping.dmp