Analysis
-
max time kernel
166s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:44
Behavioral task
behavioral1
Sample
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe
Resource
win10v2004-20220812-en
General
-
Target
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe
-
Size
253KB
-
MD5
c1617b172c2d59d518dd34e999866293
-
SHA1
865f0bbc011f39e89f5eb8b6823fced407c4a5fb
-
SHA256
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0
-
SHA512
2412c449db446e51446b8f0dc66fd65a4bedba91051aa1553442d13d5c8bda1e81265afd33faa183844cb01396f1292aec0b580d784a6020bbbdeebbce634eec
-
SSDEEP
6144:Hfj70ySzxkvXBfHz6DSLn/9lcLLUJ2lSUt:748fBfHzRPQQU3t
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2040-132-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral2/memory/2040-135-0x0000000000400000-0x0000000000485000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSTransmissionController = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\mstctl32.exe" 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exedescription ioc process File opened (read-only) \??\K: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\N: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\I: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\G: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\J: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\R: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\S: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\U: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\W: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\Z: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\B: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\E: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\F: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\H: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\L: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\O: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\T: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\V: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\A: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\Y: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\X: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\P: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\Q: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe File opened (read-only) \??\M: 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exedescription pid process target process PID 2040 set thread context of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\69f85efb-6da1-4bd0-bbe6-e70d233d4c7a.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221130014925.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3228 msedge.exe 3228 msedge.exe 3708 msedge.exe 3708 msedge.exe 4624 msedge.exe 4624 msedge.exe 2928 identity_helper.exe 2928 identity_helper.exe 2584 msedge.exe 2584 msedge.exe 2584 msedge.exe 2584 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 4624 msedge.exe 4624 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exemsedge.exemsedge.exedescription pid process target process PID 2040 wrote to memory of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe PID 2040 wrote to memory of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe PID 2040 wrote to memory of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe PID 2040 wrote to memory of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe PID 2040 wrote to memory of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe PID 2040 wrote to memory of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe PID 2040 wrote to memory of 376 2040 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe PID 376 wrote to memory of 4624 376 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe msedge.exe PID 376 wrote to memory of 4624 376 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe msedge.exe PID 4624 wrote to memory of 4832 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 4832 4624 msedge.exe msedge.exe PID 376 wrote to memory of 4988 376 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe msedge.exe PID 376 wrote to memory of 4988 376 619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe msedge.exe PID 4988 wrote to memory of 2764 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 2764 4988 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 1904 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 3708 4624 msedge.exe msedge.exe PID 4624 wrote to memory of 3708 4624 msedge.exe msedge.exe PID 4988 wrote to memory of 4160 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 4160 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 4160 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 4160 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 4160 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 4160 4988 msedge.exe msedge.exe PID 4988 wrote to memory of 4160 4988 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe"C:\Users\Admin\AppData\Local\Temp\619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe"C:\Users\Admin\AppData\Local\Temp\619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8163846f8,0x7ff816384708,0x7ff8163847184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0xf4,0x100,0x108,0x128,0x7ff755955460,0x7ff755955470,0x7ff7559554805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6504 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2128,17686417842817586604,2664866437920761185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6560 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=619e2715c0200f4bce1414ec347e81d149da2277ef7fbea8c0cc941785eacaa0.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8163846f8,0x7ff816384708,0x7ff8163847184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7080916026776584915,11828899030628648828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7080916026776584915,11828899030628648828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:24⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5e1038ec8f3a7a34a787f684b16660d72
SHA1881086cd6b8ecb39591286f11b823817e402c217
SHA2568fec496daff1342705d6233ed38e4a3ab44e1c9654ba34981c75e20e4198435d
SHA51220c7cfd6c561f44b8d8a90395363945aac33d280183801f866b61b55e780058143ce6c0bc024c4fda4be53f499cf802a26a2cc6f7262f27408d7a4982f34cdb7
-
\??\pipe\LOCAL\crashpad_4624_HCAMTZEPFIMUJEPNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4988_NAPBUDMDSCPOGSFAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/376-134-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/376-133-0x0000000000000000-mapping.dmp
-
memory/560-154-0x0000000000000000-mapping.dmp
-
memory/760-165-0x0000000000000000-mapping.dmp
-
memory/1204-158-0x0000000000000000-mapping.dmp
-
memory/1400-174-0x0000000000000000-mapping.dmp
-
memory/1644-172-0x0000000000000000-mapping.dmp
-
memory/1660-175-0x0000000000000000-mapping.dmp
-
memory/1784-176-0x0000000000000000-mapping.dmp
-
memory/1904-147-0x0000000000000000-mapping.dmp
-
memory/1980-170-0x0000000000000000-mapping.dmp
-
memory/2040-132-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/2040-135-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/2420-156-0x0000000000000000-mapping.dmp
-
memory/2584-178-0x0000000000000000-mapping.dmp
-
memory/2764-139-0x0000000000000000-mapping.dmp
-
memory/2928-177-0x0000000000000000-mapping.dmp
-
memory/3228-151-0x0000000000000000-mapping.dmp
-
memory/3564-180-0x0000000000000000-mapping.dmp
-
memory/3708-148-0x0000000000000000-mapping.dmp
-
memory/3712-160-0x0000000000000000-mapping.dmp
-
memory/4160-150-0x0000000000000000-mapping.dmp
-
memory/4624-136-0x0000000000000000-mapping.dmp
-
memory/4720-167-0x0000000000000000-mapping.dmp
-
memory/4832-137-0x0000000000000000-mapping.dmp
-
memory/4988-138-0x0000000000000000-mapping.dmp
-
memory/5024-162-0x0000000000000000-mapping.dmp