Analysis
-
max time kernel
151s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 23:39
Static task
static1
Behavioral task
behavioral1
Sample
742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
Resource
win7-20220812-en
General
-
Target
742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe
-
Size
1.1MB
-
MD5
75342cdd702056910a3fce3b434cf1b1
-
SHA1
02728d0ad5e5c1f34ee3bd77bb7af144f83438f9
-
SHA256
742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d
-
SHA512
dd6dc0a07f0ffbbf0793c3e97d86de80720e6dca0216441b3ab46014975e186b975887a8cde3530b7a43fcbc078788ebe8df5fd065c0ac5779b98febaf7409ec
-
SSDEEP
24576:Ktb20pkaCqT5TBWgNQ7aulZsRTXRDL6nY935ZSS6A:3Vg5tQ7aulZsRTXRD/55
Malware Config
Extracted
nanocore
1.2.2.0
moftsvs.ig42.org:9045
212.7.192.242:9045
c7bf44a3-7212-4d60-9ee3-f0991c8392f8
-
activate_away_mode
false
-
backup_connection_host
212.7.192.242
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-03-06T14:55:41.478810836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
9045
-
default_group
Default Team
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
c7bf44a3-7212-4d60-9ee3-f0991c8392f8
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
moftsvs.ig42.org
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4976 set thread context of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\646b890e-56a4-4aa3-bb0a-c2ea9f964066.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221127180609.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1832 msedge.exe 1832 msedge.exe 4432 msedge.exe 4432 msedge.exe 3112 msedge.exe 3112 msedge.exe 2192 identity_helper.exe 2192 identity_helper.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 4976 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 82 PID 2348 wrote to memory of 4976 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 82 PID 2348 wrote to memory of 4976 2348 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 82 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 4976 wrote to memory of 4852 4976 742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe 84 PID 3112 wrote to memory of 4492 3112 msedge.exe 86 PID 3112 wrote to memory of 4492 3112 msedge.exe 86 PID 4588 wrote to memory of 3900 4588 msedge.exe 90 PID 4588 wrote to memory of 3900 4588 msedge.exe 90 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 3772 3112 msedge.exe 91 PID 3112 wrote to memory of 1832 3112 msedge.exe 92 PID 3112 wrote to memory of 1832 3112 msedge.exe 92 PID 3112 wrote to memory of 4756 3112 msedge.exe 93 PID 3112 wrote to memory of 4756 3112 msedge.exe 93 PID 3112 wrote to memory of 4756 3112 msedge.exe 93 PID 3112 wrote to memory of 4756 3112 msedge.exe 93 PID 3112 wrote to memory of 4756 3112 msedge.exe 93 PID 3112 wrote to memory of 4756 3112 msedge.exe 93 PID 3112 wrote to memory of 4756 3112 msedge.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\lf2" "C:\Users\Admin\AppData\Local\Temp\742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe" "742ce52cd8a692158fc20d0df48b688449c432f31a0d1854eda3f83d1324f76d.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"3⤵PID:4852
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x9c,0x7fff264546f8,0x7fff26454708,0x7fff264547185⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:25⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:85⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:15⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:15⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:15⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5376 /prefetch:85⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:15⤵PID:904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:15⤵PID:2508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5904 /prefetch:85⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:15⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:15⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:85⤵PID:804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
PID:2344 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7e4a65460,0x7ff7e4a65470,0x7ff7e4a654806⤵PID:800
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13912538217725163190,1830796934267417902,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6744 /prefetch:25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1200
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff264546f8,0x7fff26454708,0x7fff264547185⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13604194932714758585,14896589861932787475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:25⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,13604194932714758585,14896589861932787475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2784
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize471B
MD58212d70c86ce431d59072c64f70a8279
SHA1b221f0de1fb741bff50d0536566f1a9602757ee1
SHA256b43ab742a745a5293b46de337819f22995835f52e29656ff8fb2eb5a1f569229
SHA51208925c1502691ca0eebc03dcf82ba0efba59a3c480edbe7ace5632fcd2cb4d03895bb3babd41effa627b162bd3d88d51b8daeeadd657e49d39b4ebb202281d0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize412B
MD5a69e4ee0072e3cb212e468f14886311a
SHA1b84d2ca5e7225b91520f339e177aff66428eef45
SHA256cc2e41a8086eb84d9dcdfbbd3b4eb9e33d8bab2978da4c07e7abe71127243ee4
SHA51275875cddcccae57c29c23ad379785b02d547dea833a9efb38374d63b0d7a9e41dc3b6e6160b0744ab9c83e33dabc144dd9f704b1c338013a932c5a962a63d4fc
-
Filesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
Filesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
Filesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
Filesize
2KB
MD5243c3736c5a812414cf59bf5600d3f4d
SHA1f52022f1d87b8777bf4c52aa49f7e4a50f809920
SHA256d2ce657b337b662618cd98db06cacf588e5740ed3eb2bea3b4692409a331a43a
SHA512ed507ee2ec851004e2b27eb16b1da05aa06848754c4adf2327f8802bf018d34822fba75049fb34d8a054387a9994900c86d5c41678155881460818d885e3dd77
-
Filesize
202KB
MD562cddffde88715a338548dbfa47b555c
SHA117d9eed664beee32f9fa62d61daaaac931885e51
SHA25606538639dc35c0781397871581f21949a11afd5080d0f6a69b5c09c8d278cb8a
SHA5120fe70f5fae9ca1fee043b00bd0119dc1c5a7055881c1ed91a725a8cf7476c365e0b0d621ce35b5e6ff9e07687e5fa8901c47c4496297723288b10b39bbaa5442
-
Filesize
5KB
MD54ff1ccdb9061a9ee17931de9cc506a0f
SHA118246065474565a991de8b76043dca47c6afb51a
SHA256b513a4cace0f3b588f32baba51b487d774de220503746f56ae9a655737a6d532
SHA5126de408adf1dd625fe2917771aac3fbe5c88b1342382ee608684940e928392752ee4d7917667d25542ce982f2f86c6e06f14c6accdccba14921978ab399750886