Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 16:43
Static task
static1
Behavioral task
behavioral1
Sample
78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
Resource
win10v2004-20220812-en
General
-
Target
78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
-
Size
104KB
-
MD5
262501d948eb900c269e4888d0d416f7
-
SHA1
25f87d16ce571588a9171b0d0f6b6d80014c2cde
-
SHA256
78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729
-
SHA512
113b8599391080c544730a7ace3258dc5f7f9d9c0bdda9c110843e1fa0a97e8dfd9511827b3e638d3dd4e6204830a15874866864376914092657faf741b1efcb
-
SSDEEP
1536:lP7LRKwGuF6Cp7/LPLrVcwZxFsEBv2cfRPexCCUy1FCs:Fo7CZ/bLTFsOvLRYgyfCs
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exedescription pid process target process PID 1824 set thread context of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1ab5bd9b-6883-4d3b-ae66-fa784b0f4b96.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221201031039.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 1356 msedge.exe 1356 msedge.exe 5012 msedge.exe 5012 msedge.exe 4676 msedge.exe 4676 msedge.exe 4712 identity_helper.exe 4712 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 4676 msedge.exe 4676 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exepid process 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exemsedge.exemsedge.exedescription pid process target process PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 1824 wrote to memory of 4812 1824 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe PID 4812 wrote to memory of 1420 4812 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe msedge.exe PID 4812 wrote to memory of 1420 4812 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe msedge.exe PID 1420 wrote to memory of 3724 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 3724 1420 msedge.exe msedge.exe PID 4812 wrote to memory of 4676 4812 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe msedge.exe PID 4812 wrote to memory of 4676 4812 78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe msedge.exe PID 4676 wrote to memory of 2612 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 2612 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 4676 wrote to memory of 4360 4676 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe PID 1420 wrote to memory of 4420 1420 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe"C:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exeC:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa68dd46f8,0x7ffa68dd4708,0x7ffa68dd47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13010435050851690363,11680905648547206709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13010435050851690363,11680905648547206709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa68dd46f8,0x7ffa68dd4708,0x7ffa68dd47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6072 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff644de5460,0x7ff644de5470,0x7ff644de54805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1772 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3356 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3376 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2144,15194341694378331656,5193916252255222196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1740 /prefetch:84⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
471B
MD5302ccc431609cad913893a5762258293
SHA1c88d15ce7198f7296e281fd342d621618a1eddb9
SHA2563963c5a71bd7299478ffdb264b1e8d812aa9598d8d74413ab29268a0545fccb5
SHA512520870fd7d55484064ec7950fd74646140a240cec3261691807dbb857f2a6285d587ebfa34a70d122f9cb9b5d59ca0441e965648eb592333d90fa29ef7f42b18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEFilesize
446B
MD5ea2ca6d6392493c95c44a12c62457b07
SHA14ca109d3747e16d0f405c75a6333e5802a874563
SHA256ecc16508dba9088f201840d4b49d392d47dd4560e10c97148ee20d26d2de578f
SHA5121cdd2eecc985536271db2af93d20ed93ad9eeb5a587191704f87726200482ef6642e1e2454e2c99cf1c3715c7700e811cfe84afd9d6917ded3af2a89b2815c01
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e1661723f09a6aed8290c3f836ef2c2b
SHA155e08c810da94c08c5ee54ace181d4347f4e2ae5
SHA256a6527662d502234a1a9847973eb8e39e817aa145c43514229ba720150f74a2f2
SHA512dcd1e6320510594dd86568608d905ad5aacd4fa2b3369ac4daa1b938f7f0597da64747875a3567e5c05e5de34f77d87f5effdfda8091d01354699711f4bc12ad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b3f352bbc8046d1d5d84c5bb693e2e5
SHA1e9d1ec6341b7959453e7cfb1ec65a55bf415cd4c
SHA256471da5f4a494fb6adb027e3fd80765a6c27a3967208aad8fb55e38a3f7fca7da
SHA512c984248535cb94fc265e93b9001d5936697dd2ff3ef8dfedd014df64b5f76e031eea1a594db3085e0149794ad90802a45c6cd985035ba383d1bf80ed928ff809
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD521269efef07dfa402bc8c0944f6bb8f6
SHA167e15514f40abb37d8543f580cb1864d7373f284
SHA2563e2d8a121cd97f894b7bce0f9a6e568de2a0878357490deb31b3174e803a2a6a
SHA512317935d85942d0727cf620455cfcb4da2fe4c5f3804982389a15212bc81ed400110b5de503a41770b5bb153a7f556676118f22d6571538c448c38dcb3e1c8ea8
-
\??\pipe\LOCAL\crashpad_1420_AOFCRTESPYEBOOCJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4676_AWNGCQWODMPTQAGNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1048-175-0x0000000000000000-mapping.dmp
-
memory/1356-150-0x0000000000000000-mapping.dmp
-
memory/1376-155-0x0000000000000000-mapping.dmp
-
memory/1420-136-0x0000000000000000-mapping.dmp
-
memory/1584-164-0x0000000000000000-mapping.dmp
-
memory/1624-177-0x0000000000000000-mapping.dmp
-
memory/1824-186-0x0000000000000000-mapping.dmp
-
memory/1856-188-0x0000000000000000-mapping.dmp
-
memory/2224-182-0x0000000000000000-mapping.dmp
-
memory/2288-173-0x0000000000000000-mapping.dmp
-
memory/2544-179-0x0000000000000000-mapping.dmp
-
memory/2612-139-0x0000000000000000-mapping.dmp
-
memory/2620-162-0x0000000000000000-mapping.dmp
-
memory/3040-160-0x0000000000000000-mapping.dmp
-
memory/3684-166-0x0000000000000000-mapping.dmp
-
memory/3724-137-0x0000000000000000-mapping.dmp
-
memory/3760-170-0x0000000000000000-mapping.dmp
-
memory/3876-184-0x0000000000000000-mapping.dmp
-
memory/4072-178-0x0000000000000000-mapping.dmp
-
memory/4360-148-0x0000000000000000-mapping.dmp
-
memory/4420-149-0x0000000000000000-mapping.dmp
-
memory/4536-168-0x0000000000000000-mapping.dmp
-
memory/4676-138-0x0000000000000000-mapping.dmp
-
memory/4712-180-0x0000000000000000-mapping.dmp
-
memory/4812-135-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4812-134-0x0000000000000000-mapping.dmp
-
memory/5012-152-0x0000000000000000-mapping.dmp