Analysis
-
max time kernel
172s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 07:25
Static task
static1
Behavioral task
behavioral1
Sample
9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe
Resource
win10v2004-20220812-en
General
-
Target
9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe
-
Size
1.7MB
-
MD5
de8f507d8ced9abe1b50ca36361a2de6
-
SHA1
903c00428f1239fe3c8538d9c3348caa0915c18d
-
SHA256
9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7
-
SHA512
700219b20717feea27d20d26e44f3dd11d547f1da21f7cd38c591beecb79790c3ef3b4b2c95de790ec8c6b0b42facad84419802fdc30387d5dcfaef61b96dc23
-
SSDEEP
24576:b5SuxQf2VotQU1aWyyk4rV9kis/Gu4rEH/Oav6rbVf+iGEF2jnq8gs2hsC5e:b5SucTazBGTm/OacVf+rWKbg5de
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exedescription pid process target process PID 1016 set thread context of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cf107890-9ea4-4c35-8a96-f3a6e0b49a69.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221202024129.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2380 msedge.exe 2380 msedge.exe 4824 msedge.exe 4824 msedge.exe 4992 msedge.exe 4992 msedge.exe 2424 identity_helper.exe 2424 identity_helper.exe 2356 msedge.exe 2356 msedge.exe 2356 msedge.exe 2356 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 4992 msedge.exe 4992 msedge.exe 4992 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exemsedge.exemsedge.exedescription pid process target process PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 1016 wrote to memory of 4976 1016 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe PID 4976 wrote to memory of 4992 4976 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe msedge.exe PID 4976 wrote to memory of 4992 4976 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe msedge.exe PID 4992 wrote to memory of 5036 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 5036 4992 msedge.exe msedge.exe PID 4976 wrote to memory of 3828 4976 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe msedge.exe PID 4976 wrote to memory of 3828 4976 9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe msedge.exe PID 3828 wrote to memory of 4316 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 4316 3828 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 4992 wrote to memory of 752 4992 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe PID 3828 wrote to memory of 956 3828 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe"C:\Users\Admin\AppData\Local\Temp\9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe"C:\Users\Admin\AppData\Local\Temp\9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8352e46f8,0x7ff8352e4708,0x7ff8352e47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5208 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5324 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff785625460,0x7ff785625470,0x7ff7856254805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5432 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2152,18145379020305131881,9690305749746652302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9166d75269a02fe9e1ffaa2dca54bc701240fc8e2d374f46cf9500739c75aef7.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.03⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8352e46f8,0x7ff8352e4708,0x7ff8352e47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7769252636253809082,15553188130249772200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,7769252636253809082,15553188130249772200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177Filesize
471B
MD5d1287b882680d426851631f5cc6f98d8
SHA16182ed7f6b85ad3fdf2de7d50f78802aea537753
SHA2564afcd48438f2bc14b1f22635e5ad8f9b5519de90fb04af02ad6ab017a505a4f0
SHA51212817b72604ae58c4a33f4eb43c00554938a25df605c674f9d53c50d1d386555b6324906b99ec6a46a086853ee9c10acfefd85722dedb732f5e31ac6e93c797a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177Filesize
442B
MD5da73e135a7f40e70919f2be47d1d067c
SHA1ae882bd2cdb793874c540eea996bf5f371db453d
SHA256c5db8ce4133448b9354e94c50590bf8eb518b5544f3c88a46570f0005e9580ec
SHA5126a522a128c5fa9956393a22e1bfecf1ef19284fb49818718352bdf1559184719edda38f44bd0d01fe8954bf89c7bef04b45fe78c30df95588d428e02e5537dd1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5727230d7b0f8df1633bc043529f5c15d
SHA15b24d959d4c5dcf8125125dbee37225d6160af18
SHA25654961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998
SHA51235735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57b4b103831d353776ed8bfcc7676f9df
SHA140f33a3f791fda49a35224a469cc67b94ca53a23
SHA256bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85
SHA5125cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD583271ee3d800bd25e9f3c8bf682de024
SHA18878b97e381a16a1bf98132e500fe65793cbef9d
SHA2568d72ebf1d1e5c6ec9f38055395559207f17b47fefa3866bdf19064e3f6b8d660
SHA5121fd9af07a43a7f4517e71984f09edfc255f32eca57a8091f43a73bcffdfa7d6d76a7fb1a89b9adf92f983a37da41f2304e3df22cde4ca302f643d075558c01de
-
\??\pipe\LOCAL\crashpad_3828_LQMSKHMVJAHOMARTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4992_WZYBYEAXJQSNVHLWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/752-145-0x0000000000000000-mapping.dmp
-
memory/956-148-0x0000000000000000-mapping.dmp
-
memory/1828-165-0x0000000000000000-mapping.dmp
-
memory/2356-179-0x0000000000000000-mapping.dmp
-
memory/2380-147-0x0000000000000000-mapping.dmp
-
memory/2424-178-0x0000000000000000-mapping.dmp
-
memory/2500-171-0x0000000000000000-mapping.dmp
-
memory/2852-160-0x0000000000000000-mapping.dmp
-
memory/3068-153-0x0000000000000000-mapping.dmp
-
memory/3136-176-0x0000000000000000-mapping.dmp
-
memory/3828-139-0x0000000000000000-mapping.dmp
-
memory/3944-158-0x0000000000000000-mapping.dmp
-
memory/4152-173-0x0000000000000000-mapping.dmp
-
memory/4316-140-0x0000000000000000-mapping.dmp
-
memory/4332-169-0x0000000000000000-mapping.dmp
-
memory/4336-175-0x0000000000000000-mapping.dmp
-
memory/4344-181-0x0000000000000000-mapping.dmp
-
memory/4544-177-0x0000000000000000-mapping.dmp
-
memory/4824-149-0x0000000000000000-mapping.dmp
-
memory/4848-162-0x0000000000000000-mapping.dmp
-
memory/4976-134-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4976-132-0x0000000000000000-mapping.dmp
-
memory/4976-135-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4976-133-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4980-167-0x0000000000000000-mapping.dmp
-
memory/4992-137-0x0000000000000000-mapping.dmp
-
memory/5036-138-0x0000000000000000-mapping.dmp