Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 00:52
Static task
static1
Behavioral task
behavioral1
Sample
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe
Resource
win10v2004-20220812-en
General
-
Target
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe
-
Size
2.7MB
-
MD5
73b640feaa707f1db67d8bbce19cf704
-
SHA1
ade33c18143d000a08971cd18d8e874284e14a9e
-
SHA256
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715
-
SHA512
3209cc9189f92e8161a9b68e0eba3b99f54eb274ad95fd5b97f674713bfad50f3e550dc5ef11b9772d07e28ac8b80003dafe487e43c40595de3aeb0638b53d4b
-
SSDEEP
49152:rJZoQrbTFZY1iaDRwEYUbN9+qzA7LMD/Cqp+IH8LQaddDkG+d139q4cxpUuas:rtrbTA1BwJUb7lc3MDaqA0T7v8Z
Malware Config
Extracted
darkcomet
Guest16_min
iloverats12.no-ip.biz:5468
DCMIN_MUTEX-3DXPTA4
-
gencode
ji9E7fZNtWow
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
abcww.exe229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exesvchost.compid process 4336 abcww.exe 920 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 3576 svchost.com -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exeabcww.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation abcww.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe" 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe" 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exesvchost.comdescription pid process target process PID 884 set thread context of 920 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe PID 3576 set thread context of 4600 3576 svchost.com RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2fa77e3f-109d-4f3f-8f2a-0b370111416c.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221126132828.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exesvchost.commsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 3576 svchost.com 3576 svchost.com 3576 svchost.com 3576 svchost.com 4692 msedge.exe 4692 msedge.exe 5040 msedge.exe 5040 msedge.exe 5012 msedge.exe 5012 msedge.exe 6112 identity_helper.exe 6112 identity_helper.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe 5012 msedge.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
svchost.comRegSvcs.exedescription pid process Token: SeDebugPrivilege 3576 svchost.com Token: SeIncreaseQuotaPrivilege 4600 RegSvcs.exe Token: SeSecurityPrivilege 4600 RegSvcs.exe Token: SeTakeOwnershipPrivilege 4600 RegSvcs.exe Token: SeLoadDriverPrivilege 4600 RegSvcs.exe Token: SeSystemProfilePrivilege 4600 RegSvcs.exe Token: SeSystemtimePrivilege 4600 RegSvcs.exe Token: SeProfSingleProcessPrivilege 4600 RegSvcs.exe Token: SeIncBasePriorityPrivilege 4600 RegSvcs.exe Token: SeCreatePagefilePrivilege 4600 RegSvcs.exe Token: SeBackupPrivilege 4600 RegSvcs.exe Token: SeRestorePrivilege 4600 RegSvcs.exe Token: SeShutdownPrivilege 4600 RegSvcs.exe Token: SeDebugPrivilege 4600 RegSvcs.exe Token: SeSystemEnvironmentPrivilege 4600 RegSvcs.exe Token: SeChangeNotifyPrivilege 4600 RegSvcs.exe Token: SeRemoteShutdownPrivilege 4600 RegSvcs.exe Token: SeUndockPrivilege 4600 RegSvcs.exe Token: SeManageVolumePrivilege 4600 RegSvcs.exe Token: SeImpersonatePrivilege 4600 RegSvcs.exe Token: SeCreateGlobalPrivilege 4600 RegSvcs.exe Token: 33 4600 RegSvcs.exe Token: 34 4600 RegSvcs.exe Token: 35 4600 RegSvcs.exe Token: 36 4600 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 5012 msedge.exe 5012 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 4600 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exeabcww.exesvchost.com229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exemsedge.exemsedge.exedescription pid process target process PID 884 wrote to memory of 4336 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe abcww.exe PID 884 wrote to memory of 4336 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe abcww.exe PID 884 wrote to memory of 4336 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe abcww.exe PID 884 wrote to memory of 920 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe PID 884 wrote to memory of 920 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe PID 884 wrote to memory of 920 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe PID 884 wrote to memory of 920 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe PID 884 wrote to memory of 920 884 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe PID 4336 wrote to memory of 3576 4336 abcww.exe svchost.com PID 4336 wrote to memory of 3576 4336 abcww.exe svchost.com PID 4336 wrote to memory of 3576 4336 abcww.exe svchost.com PID 3576 wrote to memory of 4600 3576 svchost.com RegSvcs.exe PID 3576 wrote to memory of 4600 3576 svchost.com RegSvcs.exe PID 3576 wrote to memory of 4600 3576 svchost.com RegSvcs.exe PID 3576 wrote to memory of 4600 3576 svchost.com RegSvcs.exe PID 3576 wrote to memory of 4600 3576 svchost.com RegSvcs.exe PID 920 wrote to memory of 3496 920 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe msedge.exe PID 920 wrote to memory of 3496 920 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe msedge.exe PID 3496 wrote to memory of 3592 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 3592 3496 msedge.exe msedge.exe PID 920 wrote to memory of 5012 920 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe msedge.exe PID 920 wrote to memory of 5012 920 229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe msedge.exe PID 5012 wrote to memory of 4672 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4672 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 5012 wrote to memory of 4412 5012 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4300 3496 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe"C:\Users\Admin\AppData\Local\Temp\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\abcww.exe"C:\Users\Admin\AppData\Local\Temp\abcww.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\4ra4y817c97ie8r\svchost.com"C:\Users\Admin\4ra4y817c97ie8r\svchost.com" TcygyJaYqRz3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe"C:\Users\Admin\AppData\Local\Temp\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb3b46f8,0x7ffedb3b4708,0x7ffedb3b47184⤵PID:3592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17694756832231086944,17076700405148763953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:24⤵PID:4300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17694756832231086944,17076700405148763953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:5040 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedb3b46f8,0x7ffedb3b4708,0x7ffedb3b47184⤵PID:4672
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:24⤵PID:4412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:84⤵PID:1720
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:14⤵PID:624
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:14⤵PID:1820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:14⤵PID:4392
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 /prefetch:84⤵PID:3268
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:14⤵PID:364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:14⤵PID:1856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4176 /prefetch:84⤵PID:5416
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:14⤵PID:5476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:14⤵PID:5492
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:84⤵PID:5664
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
PID:5712 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x1c4,0x7ff740375460,0x7ff740375470,0x7ff7403754805⤵PID:5752
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:6112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1312 /prefetch:84⤵PID:5176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4156 /prefetch:84⤵PID:5240
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4156 /prefetch:84⤵PID:2264
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16468714258653175912,11754026651754346266,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4248 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:1412
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\4RA4Y8~1\KSkwTKP.QFAFilesize
658KB
MD5a424d880d905f6bfaf216240a098ec05
SHA159fa2530da99e43ff2038582d60939f4fe8b8d3c
SHA25630c881072b6ccfdc9def2c1fddf5e145fcc27e346662d31cc3aeec8e56b0a057
SHA512fa4ed488ce6dec4f986161f26286e1c3f66b7a72cb9fd117ea0f01d8eb29a048bb4b04abbb7e6126ce6bda752dc44de0bb50d56fcee43373cb3853dda80174f9
-
C:\Users\Admin\4RA4Y8~1\pKVHrpGIyb.DWYFilesize
36B
MD5ec7c9b53e60d9245cd8478c1a4bae8b7
SHA131880ddbc83c3c78a4e641017c00e053690686f3
SHA256d3417789ff3c75ea0f681795062ff25ee079ff552d1f62354d1a190dc7896473
SHA512726518130e5b47a33fd234d8672c1fde23098d81d75d61fb546775eb159e88cd332a8fb9047b94136b540efb5efb3aa35aa4aaea3839cf61b3a95592d3e256ad
-
C:\Users\Admin\4ra4y817c97ie8r\TcygyJaYqRzFilesize
36.0MB
MD56db0dae7f21237cfec2175ce41e1777c
SHA11ba4d0ec47af41f1658c3fed6fa0a2a9c942ad7c
SHA256440dda76b4b4bd289c84f6a358febd4038da67bceaec1e14a1a3826b85ddc996
SHA512c9cad1b8b1308c36756f84d6254b307b3b9a4437aa1fc78664c6b6327ee69cdf7540b00042490f805503b60b5c01d3beb30ba85d176dff1b4b931443345be368
-
C:\Users\Admin\4ra4y817c97ie8r\svchost.comFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\4ra4y817c97ie8r\svchost.comFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
471B
MD5c60e7e6da2d6abb70c52f8d7b6733e00
SHA1d480d5088a78313b2bbe69155f7221589d3e07f0
SHA256b02a43decd64469acb3576ec0823561fceb2deb65e4087112a40a2f1fdff3fc2
SHA512e4589428ccbfb91b64f61b5700e75da4e955b8fb6ecf8602053b3c32a70024ae13bc7f84d179adc7b9fd9b1f86ad0b9c7998db9de05c1995ca0f131a320fedca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
446B
MD5a5c4b6985a3494046f45fa7d4fca16c1
SHA1269956513cea32110feb9358cd6d26f56a55953b
SHA2564d90d766cbc37ee09371492152717e391643afd9fd1cbc1b66a214417636c434
SHA5123b18955934801d1c3376ae6df5e910ae0824fd42c647e4a9c678bbbb176dbfb1fb64eaaa47c30306905ec03a509339c82983a1a320e09e5f89e74275ac42cb7b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD50803a7b328704f2f2836aa0bc2196677
SHA1958caaaaad41c41ad72db99760a97de1a4fb35b9
SHA256ea01456673424cab354a50cd16017a9cbee1ec25e4c39e6c54a0d427d0d04f3b
SHA512ca8f278523f936c4c0c04942f7e82501cbd2227e6dc8fd7cad13fa45f9be6bd3a78cb07673b73801686854fc91e0b2fed5725e75125466c0e560da1624f03ca7
-
C:\Users\Admin\AppData\Local\Temp\229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715.exeFilesize
2.7MB
MD573b640feaa707f1db67d8bbce19cf704
SHA1ade33c18143d000a08971cd18d8e874284e14a9e
SHA256229b7afff666947ed7dec8b56c55727571dc42404121005efdfd44e327631715
SHA5123209cc9189f92e8161a9b68e0eba3b99f54eb274ad95fd5b97f674713bfad50f3e550dc5ef11b9772d07e28ac8b80003dafe487e43c40595de3aeb0638b53d4b
-
C:\Users\Admin\AppData\Local\Temp\abcww.exeFilesize
1.2MB
MD5647da917e7d04ba870f7f54f759358b2
SHA1e108af9667835ce2e3f105e94a0279d794a8961e
SHA256f144535fa726bd0d9b508bc3cdd0b79b628933144dc66247d21769cd7c86486c
SHA5127b16b449cc054dc1620a54febe259bf3928613797d3bb74d71f1c571b471a46aaa4d1d8842d433545baf75c812602c075e3d2c87a3676dc0bbef53f834cc21bb
-
C:\Users\Admin\AppData\Local\Temp\abcww.exeFilesize
1.2MB
MD5647da917e7d04ba870f7f54f759358b2
SHA1e108af9667835ce2e3f105e94a0279d794a8961e
SHA256f144535fa726bd0d9b508bc3cdd0b79b628933144dc66247d21769cd7c86486c
SHA5127b16b449cc054dc1620a54febe259bf3928613797d3bb74d71f1c571b471a46aaa4d1d8842d433545baf75c812602c075e3d2c87a3676dc0bbef53f834cc21bb
-
\??\pipe\LOCAL\crashpad_3496_PXAFAWXOYMZWNBCLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_5012_RVVBUAFABUSQPDWXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/364-180-0x0000000000000000-mapping.dmp
-
memory/624-170-0x0000000000000000-mapping.dmp
-
memory/920-136-0x00000000000D0000-0x000000000015C000-memory.dmpFilesize
560KB
-
memory/920-135-0x0000000000000000-mapping.dmp
-
memory/1412-199-0x0000000000000000-mapping.dmp
-
memory/1720-167-0x0000000000000000-mapping.dmp
-
memory/1820-172-0x0000000000000000-mapping.dmp
-
memory/1856-182-0x0000000000000000-mapping.dmp
-
memory/2264-198-0x0000000000000000-mapping.dmp
-
memory/3268-176-0x0000000000000000-mapping.dmp
-
memory/3496-148-0x0000000000000000-mapping.dmp
-
memory/3576-138-0x0000000000000000-mapping.dmp
-
memory/3592-150-0x0000000000000000-mapping.dmp
-
memory/4300-159-0x0000000000000000-mapping.dmp
-
memory/4336-132-0x0000000000000000-mapping.dmp
-
memory/4392-174-0x0000000000000000-mapping.dmp
-
memory/4412-158-0x0000000000000000-mapping.dmp
-
memory/4600-146-0x0000000000D00000-0x0000000000DB2000-memory.dmpFilesize
712KB
-
memory/4600-162-0x0000000000D00000-0x0000000000DB2000-memory.dmpFilesize
712KB
-
memory/4600-149-0x0000000000D00000-0x0000000000DB2000-memory.dmpFilesize
712KB
-
memory/4600-147-0x0000000000D00000-0x0000000000DB2000-memory.dmpFilesize
712KB
-
memory/4600-144-0x0000000000000000-mapping.dmp
-
memory/4600-145-0x0000000000D00000-0x0000000000DB2000-memory.dmpFilesize
712KB
-
memory/4672-152-0x0000000000000000-mapping.dmp
-
memory/4692-161-0x0000000000000000-mapping.dmp
-
memory/5012-151-0x0000000000000000-mapping.dmp
-
memory/5040-163-0x0000000000000000-mapping.dmp
-
memory/5176-194-0x0000000000000000-mapping.dmp
-
memory/5240-196-0x0000000000000000-mapping.dmp
-
memory/5416-185-0x0000000000000000-mapping.dmp
-
memory/5476-187-0x0000000000000000-mapping.dmp
-
memory/5492-189-0x0000000000000000-mapping.dmp
-
memory/5712-190-0x0000000000000000-mapping.dmp
-
memory/5752-191-0x0000000000000000-mapping.dmp
-
memory/6112-192-0x0000000000000000-mapping.dmp