Analysis
-
max time kernel
154s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
General
-
Target
77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe
-
Size
2.4MB
-
MD5
b3b1fc31d4a94ffead66a5a9e0edbbba
-
SHA1
3b0c303c32b317804373dd1163d6b7dec1cd4aec
-
SHA256
77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355
-
SHA512
0f3d6172ab72763dfc63f9338c948cb497837487ab05613f6b0aaa4bb13dfe16822697ea3bfc1d75f157f24ab6211a50ab1e00f659d66f9b8e87cba3a3b1f903
-
SSDEEP
49152:Mkx2oEFHB31fIcFDWDgHtkwm2YmTuPq23yDnEIsk+VaMKXS2fLnS9UjCgZ/KWh:FxKHB31gkz3m2YmTuSKhIl4KDS9U5K
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe -
resource yara_rule behavioral2/memory/2248-137-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-139-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-140-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-141-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-142-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-144-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-146-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-148-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-150-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-152-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-154-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-156-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-158-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-160-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-162-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-164-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-166-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-168-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-170-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-172-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-174-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-176-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-178-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-182-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-180-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral2/memory/2248-183-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe 3112 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: 33 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe Token: SeIncBasePriorityPrivilege 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3112 msedge.exe 3112 msedge.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3112 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 86 PID 2248 wrote to memory of 3112 2248 77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe 86 PID 3112 wrote to memory of 4104 3112 msedge.exe 87 PID 3112 wrote to memory of 4104 3112 msedge.exe 87 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 1532 3112 msedge.exe 90 PID 3112 wrote to memory of 2952 3112 msedge.exe 91 PID 3112 wrote to memory of 2952 3112 msedge.exe 91 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92 PID 3112 wrote to memory of 1456 3112 msedge.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe"C:\Users\Admin\AppData\Local\Temp\77787324a11241bb9419d5fa816782eb513ff516f76489d061bc4dc36817b355.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cfwudao.cc/2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x78,0x104,0x7fff3cb646f8,0x7fff3cb64708,0x7fff3cb647183⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,7894497905378314841,6367085604841577033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:23⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,7894497905378314841,6367085604841577033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:33⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,7894497905378314841,6367085604841577033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:83⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7894497905378314841,6367085604841577033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:13⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7894497905378314841,6367085604841577033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:13⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7894497905378314841,6367085604841577033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:13⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,7894497905378314841,6367085604841577033,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:13⤵PID:2256
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:64