Analysis
-
max time kernel
153s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 00:05
Static task
static1
Behavioral task
behavioral1
Sample
75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe
Resource
win10v2004-20220812-en
General
-
Target
75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe
-
Size
1.0MB
-
MD5
48374eaeed5a8135eb2a9c51888123af
-
SHA1
477877d867bae864e8dcc241a19b4f756279670a
-
SHA256
75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de
-
SHA512
ef5d1b7723b8fd122f5f67f07e4688a3c13fca3c031f5e1ccb152035374d211a6d763a3796c8c6a63a78b6167b5498511606801a00a46100122a7f04cc7ae50a
-
SSDEEP
24576:Qc936BzWF4GH0W4Xj3rK84mgLaLFpxG6/DgaHihsO:n68F4GH+z94xLaLFS6/sYO
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exedescription pid process target process PID 3112 set thread context of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 set thread context of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\85494dbf-9235-4ff5-a4e5-9434932e5e34.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221126123007.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1776 msedge.exe 1776 msedge.exe 3828 msedge.exe 3828 msedge.exe 4560 msedge.exe 4560 msedge.exe 3132 identity_helper.exe 3132 identity_helper.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exesvchost.exemsedge.exesvchost.exemsedge.exedescription pid process target process PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 4912 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 4912 wrote to memory of 4560 4912 svchost.exe msedge.exe PID 4912 wrote to memory of 4560 4912 svchost.exe msedge.exe PID 4560 wrote to memory of 4092 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4092 4560 msedge.exe msedge.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 3112 wrote to memory of 1004 3112 75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe svchost.exe PID 1004 wrote to memory of 220 1004 svchost.exe msedge.exe PID 1004 wrote to memory of 220 1004 svchost.exe msedge.exe PID 220 wrote to memory of 2824 220 msedge.exe msedge.exe PID 220 wrote to memory of 2824 220 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe PID 4560 wrote to memory of 4740 4560 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe"C:\Users\Admin\AppData\Local\Temp\75cacf05bc521df56fab4fc60fcb4acedf5b8245b817d180f9fe8251b4e746de.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab2c846f8,0x7ffab2c84708,0x7ffab2c847184⤵PID:4092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:24⤵PID:4740
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:84⤵PID:3320
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:14⤵PID:1560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:14⤵PID:512
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:14⤵PID:4800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:14⤵PID:548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:14⤵PID:3940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:14⤵PID:4004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:14⤵PID:4008
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6624 /prefetch:84⤵PID:4264
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:14⤵PID:4816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:14⤵PID:3312
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:14⤵PID:2600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:14⤵PID:3788
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
PID:3828 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff681f35460,0x7ff681f35470,0x7ff681f354805⤵PID:1472
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7976 /prefetch:84⤵PID:1412
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7976 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3936 /prefetch:84⤵PID:2560
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1492,13953615182556270419,11392437005063926123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3208 /prefetch:84⤵PID:3108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.03⤵PID:3812
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab2c846f8,0x7ffab2c84708,0x7ffab2c847184⤵PID:3068
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.03⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffab2c846f8,0x7ffab2c84708,0x7ffab2c847184⤵PID:2824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1444,7638790893604554485,11429340529804849397,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:24⤵PID:4584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1444,7638790893604554485,11429340529804849397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.03⤵PID:2672
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab2c846f8,0x7ffab2c84708,0x7ffab2c847184⤵PID:3400
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD5f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177Filesize
471B
MD5ece85bff107540f30635968246dd4fda
SHA14ed88efd6cd89eed10f0967b0dfeeb0194195a25
SHA25688ba17ccbc8563d961c2eb3db1db153aa869d530d68ad43d2ac55d0b8768aa8a
SHA51281304d99dccf126b6ee473aab9b2e82413183586dfcfe29fbf452de8a2cd6d5404b181aac3eb323f393376b1f8db1522c3a98f5823733c5f0aab2498c22a1267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
340B
MD5eebc9ce707cfd70030011a0af28da617
SHA1f4fb12a4028cea2cf89c8f7938a01c20b1199f01
SHA2568a4dc1f4dfb01e1af09e1cc1426be7c02b84e3d576d5e5627fcb96c75489cb85
SHA512519b74f49443232f01c92822dfed79eb9930d877ce0ac91a0baa23a8d6c97383ddaf31d95448e9c1abff8cc05b8b368b7220fd058c768622db2889ed0dbab24b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177Filesize
442B
MD513a278177c70b6eaefa192c8e58dd60e
SHA194ebbe44b6ff092a8bcf35dc25737962f05e87b1
SHA256e316bd6e6a82301474f505ee0a6daaf5192512638a603654664053577af6807b
SHA512c4bbec5a8b6c272c0c9b4a29677a195e8691b5df619da85095c055b4b677baa81a68e9e6fe4ed71a18576e6ace7af62aa5e54002ed5f70ddb027f841e5176664
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5af05481b81fdeb6c34b41fa28542b8e1
SHA130982103d4ad165cda1b492f96da553b0d5a8663
SHA25661fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2
SHA5126671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD571b657795f1d63721f304fcf46915016
SHA1d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5d730203be89de2a255e84b248a734744
SHA1332fd14c813062d0a91a5190f11e2a0e18b3bb25
SHA256cb2e9473794b8598074971fb6cfa35c64f551adecb8383347a0f4c8bf399b905
SHA512c76d0b608f534c2771a43ef94fb9eaf576dbdf7b217ccd3a8e1fcf7cc31f8baafef01c98ed844b06ef52ad38688e9dd4a586f255648e23309a24238d3d9f16d7
-
\??\pipe\LOCAL\crashpad_220_LAQJCPEZFEQMWESTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4560_JOEZDAMYKOWZHRYRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/220-138-0x0000000000000000-mapping.dmp
-
memory/512-159-0x0000000000000000-mapping.dmp
-
memory/548-168-0x0000000000000000-mapping.dmp
-
memory/1004-136-0x0000000000000000-mapping.dmp
-
memory/1472-189-0x0000000000000000-mapping.dmp
-
memory/1560-157-0x0000000000000000-mapping.dmp
-
memory/1708-193-0x0000000000000000-mapping.dmp
-
memory/1776-144-0x0000000000000000-mapping.dmp
-
memory/2560-192-0x0000000000000000-mapping.dmp
-
memory/2600-185-0x0000000000000000-mapping.dmp
-
memory/2672-152-0x0000000000000000-mapping.dmp
-
memory/2824-139-0x0000000000000000-mapping.dmp
-
memory/3068-169-0x0000000000000000-mapping.dmp
-
memory/3108-195-0x0000000000000000-mapping.dmp
-
memory/3132-190-0x0000000000000000-mapping.dmp
-
memory/3312-183-0x0000000000000000-mapping.dmp
-
memory/3320-151-0x0000000000000000-mapping.dmp
-
memory/3400-153-0x0000000000000000-mapping.dmp
-
memory/3788-187-0x0000000000000000-mapping.dmp
-
memory/3812-164-0x0000000000000000-mapping.dmp
-
memory/3828-188-0x0000000000000000-mapping.dmp
-
memory/3828-147-0x0000000000000000-mapping.dmp
-
memory/3940-173-0x0000000000000000-mapping.dmp
-
memory/4004-175-0x0000000000000000-mapping.dmp
-
memory/4008-177-0x0000000000000000-mapping.dmp
-
memory/4092-135-0x0000000000000000-mapping.dmp
-
memory/4264-179-0x0000000000000000-mapping.dmp
-
memory/4560-134-0x0000000000000000-mapping.dmp
-
memory/4584-146-0x0000000000000000-mapping.dmp
-
memory/4740-143-0x0000000000000000-mapping.dmp
-
memory/4800-166-0x0000000000000000-mapping.dmp
-
memory/4816-181-0x0000000000000000-mapping.dmp
-
memory/4912-133-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4912-132-0x0000000000000000-mapping.dmp