Overview
overview
10Static
static
100d9e5116c1...e1.exe
windows7-x64
100d9e5116c1...e1.exe
windows10-2004-x64
10203dd97848...a7.exe
windows7-x64
1203dd97848...a7.exe
windows10-2004-x64
65d2a9e82b6...8f.exe
windows7-x64
75d2a9e82b6...8f.exe
windows10-2004-x64
7686e84d074...4d.exe
windows7-x64
686e84d074...4d.exe
windows10-2004-x64
ae30d28b17...a3.exe
windows7-x64
1ae30d28b17...a3.exe
windows10-2004-x64
6Analysis
-
max time kernel
148s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 05:52
Behavioral task
behavioral1
Sample
0d9e5116c1da200fa3a55c84ca2195eb7bbbd1e1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0d9e5116c1da200fa3a55c84ca2195eb7bbbd1e1.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
203dd97848f29e54a66e575ae670288e8fd4a5a7.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
203dd97848f29e54a66e575ae670288e8fd4a5a7.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
5d2a9e82b6098813fa230152de286f7712b5608f.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
5d2a9e82b6098813fa230152de286f7712b5608f.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
686e84d074c115785122ad304357729b28b4a54d.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
686e84d074c115785122ad304357729b28b4a54d.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
ae30d28b17fbce8e55203ad863c40bab8fe802a3.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
ae30d28b17fbce8e55203ad863c40bab8fe802a3.exe
Resource
win10v2004-20220812-en
General
-
Target
203dd97848f29e54a66e575ae670288e8fd4a5a7.exe
-
Size
14KB
-
MD5
4ff69b632636d5873a72d8b9e5f49363
-
SHA1
203dd97848f29e54a66e575ae670288e8fd4a5a7
-
SHA256
91f3be1a3664e2df90205b238a162b2686039597796066598bb9c0fe6b42fc8d
-
SHA512
a47e196f33c6cd2d6fe1a770b6dee4988229cb9662d87783c726a25b948f47907ff0aa6c91dbd6c36f3a3c747396603c3f9f96606b4ac4607c11a1516833122e
-
SSDEEP
384:o7my13Huv7D6H28j7A4qtCtSrvyhkghaSH94Fwuxd:6z3ujD6H28qCtQSH9Ad
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4988 msedge.exe 4988 msedge.exe 1856 msedge.exe 1856 msedge.exe 524 msedge.exe 524 msedge.exe 4636 identity_helper.exe 4636 identity_helper.exe 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe 2580 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 524 msedge.exe 524 msedge.exe 524 msedge.exe 524 msedge.exe 524 msedge.exe 524 msedge.exe 524 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 524 msedge.exe 524 msedge.exe 524 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
203dd97848f29e54a66e575ae670288e8fd4a5a7.exemsedge.exemsedge.exedescription pid process target process PID 1408 wrote to memory of 1392 1408 203dd97848f29e54a66e575ae670288e8fd4a5a7.exe msedge.exe PID 1408 wrote to memory of 1392 1408 203dd97848f29e54a66e575ae670288e8fd4a5a7.exe msedge.exe PID 1392 wrote to memory of 220 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 220 1392 msedge.exe msedge.exe PID 1408 wrote to memory of 524 1408 203dd97848f29e54a66e575ae670288e8fd4a5a7.exe msedge.exe PID 1408 wrote to memory of 524 1408 203dd97848f29e54a66e575ae670288e8fd4a5a7.exe msedge.exe PID 524 wrote to memory of 3664 524 msedge.exe msedge.exe PID 524 wrote to memory of 3664 524 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 1392 wrote to memory of 4928 1392 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe PID 524 wrote to memory of 1040 524 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\203dd97848f29e54a66e575ae670288e8fd4a5a7.exe"C:\Users\Admin\AppData\Local\Temp\203dd97848f29e54a66e575ae670288e8fd4a5a7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=203dd97848f29e54a66e575ae670288e8fd4a5a7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbdde746f8,0x7ffbdde74708,0x7ffbdde747183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3287722653523083006,14318657699058778193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3287722653523083006,14318657699058778193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=203dd97848f29e54a66e575ae670288e8fd4a5a7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbdde746f8,0x7ffbdde74708,0x7ffbdde747183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5368 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3820 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff757a25460,0x7ff757a25470,0x7ff757a254804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3136 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10509495672928809689,5459386983205553550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
471B
MD59f238721e0dfd68d1fd20c56c25bcdac
SHA19ef4ee704db25d9688bd479cbfb0b0c4dae94c87
SHA256d56a5dc2d1392484b9743fee8570b8414f1bfede7f0614141a86448c465b58c1
SHA51213dfbf83e7f8a5a18867af9de512943ddebf8a3c1c6d24521e23b4558b16c1a7cdfa2004ebbd4393bae4908c4d1e2a5579e1fe7a56547b5f13b0b171a9775c8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
446B
MD5c7688897eb1afb45f16f87f053bb2df9
SHA1432f911d0ba266edb9be501ffb578914833ef76d
SHA256fae8454cb60d18b3efaf8296dc70080cc371bba4fb07ca1316bb88354e284607
SHA5127e110679c1d90449e773fb053c50d0ed48a40980b16df3b3042a6316baecd03e590053639e52175ca8387afddbb1faf177263ff75e3d53e41b278a4bdefdc754
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5607b3d4300a04e01b29de07ad13cda81
SHA10bc15e4749551451c8b99600c391c245a02bc573
SHA256da7ab9e3d08bbf1b5841bd14c2ad7c595e3d61ee20f3a02085169a755fad8de6
SHA51290ef41eca9eff2244ce4b0c1e2e347df52b799f4e5effac96d48e7561212b21083a7c8531d2180afb0e5b9c518bb9edcd13481706ecb7a68fae6223bf79f820b
-
\??\pipe\LOCAL\crashpad_1392_POOKKLXZJDMVDGCTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_524_VWTMKJMONKMEPUDWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/220-133-0x0000000000000000-mapping.dmp
-
memory/376-170-0x0000000000000000-mapping.dmp
-
memory/524-134-0x0000000000000000-mapping.dmp
-
memory/1040-146-0x0000000000000000-mapping.dmp
-
memory/1392-132-0x0000000000000000-mapping.dmp
-
memory/1640-157-0x0000000000000000-mapping.dmp
-
memory/1656-159-0x0000000000000000-mapping.dmp
-
memory/1856-147-0x0000000000000000-mapping.dmp
-
memory/2580-179-0x0000000000000000-mapping.dmp
-
memory/2704-172-0x0000000000000000-mapping.dmp
-
memory/3612-168-0x0000000000000000-mapping.dmp
-
memory/3664-135-0x0000000000000000-mapping.dmp
-
memory/3804-178-0x0000000000000000-mapping.dmp
-
memory/3904-164-0x0000000000000000-mapping.dmp
-
memory/4336-166-0x0000000000000000-mapping.dmp
-
memory/4432-174-0x0000000000000000-mapping.dmp
-
memory/4564-152-0x0000000000000000-mapping.dmp
-
memory/4636-176-0x0000000000000000-mapping.dmp
-
memory/4660-155-0x0000000000000000-mapping.dmp
-
memory/4928-144-0x0000000000000000-mapping.dmp
-
memory/4988-148-0x0000000000000000-mapping.dmp
-
memory/5044-175-0x0000000000000000-mapping.dmp