f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855

Analysis

max time kernel
185s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
Size

54KB
MD5

6a0d2e1ddcdb4f1461ef6a4a3704bec4
SHA1

01779463bb41dadf41e3f164df5083a6972333bf
SHA256

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855
SHA512

8df5c43a0e345dabc0e5942a80be1e763e105e172c9444255cd0a9e80fad624acfded3570cc3f4fc2d6038f5eebc6190311ef1ba1349cec661187204e991fdab
SSDEEP

1536:TkiS+EXghBTM3Pa8+jz/3N35dw3NuuWUssgpSkPunouy8W:TkgEwHMfsxTqNmUsbpSkPuoutW

Score

6^/10

microsoft persistence phishing

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

Processes:

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe

description	pid	process	target process
PID 868 set thread context of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221203230316.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c549abd3-2148-48e3-9123-7756010f49cc.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

3720 msedge.exe
3720 msedge.exe
4700 msedge.exe
4700 msedge.exe
2536 msedge.exe
2536 msedge.exe
5048 identity_helper.exe
5048 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2536 msedge.exe
2536 msedge.exe
2536 msedge.exe
2536 msedge.exe
2536 msedge.exe
2536 msedge.exe
2536 msedge.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msedge.exe

pid process

2536 msedge.exe
2536 msedge.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe

pid process

868 f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
3720	msedge.exe
3720	msedge.exe
4700	msedge.exe
4700	msedge.exe
2536	msedge.exe
2536	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe

pid	process
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe

pid	process
2536	msedge.exe
2536	msedge.exe

pid	process
868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exef3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exemsedge.exemsedge.exe

description	pid	process	target process
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 868 wrote to memory of 2032	868	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
PID 2032 wrote to memory of 2536	2032	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	msedge.exe
PID 2032 wrote to memory of 2536	2032	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	msedge.exe
PID 2032 wrote to memory of 2028	2032	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	msedge.exe
PID 2032 wrote to memory of 2028	2032	f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe	msedge.exe
PID 2536 wrote to memory of 2092	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 2092	2536	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4248	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 4248	2028	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2536 wrote to memory of 4720	2536	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe
PID 2028 wrote to memory of 3664	2028	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
"C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868

C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe
"C:\Users\Admin\AppData\Local\Temp\f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffc195b46f8,0x7ffc195b4708,0x7ffc195b4718
4⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
4⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
4⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
4⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
4⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
4⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5276 /prefetch:8
4⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5976 /prefetch:8
4⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
4⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
4⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
4⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
4⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:8
4⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Drops file in Program Files directory
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff74fba5460,0x7ff74fba5470,0x7ff74fba5480
5⤵
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6773866522332727848,16722857149129089738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f3e930cc4533d509db9d9b56b0138996b426cb98d533d105db7e1d520d7ce855.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc195b46f8,0x7ffc195b4708,0x7ffc195b4718
4⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6740995217283074535,6106376195837157929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
4⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6740995217283074535,6106376195837157929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Filesize
471B

MD5
d74f887f7a680d06f027478f34f8ef90

SHA1
69869cb5fabb9f3ea483e7e789ed885d3c131f40

SHA256
f106a7af863c23c035166502a840e95f549b40ba1eded37331d5b8b6ce860827

SHA512
79069de009e62222476d863780b92c7a09f2567c3b79ccc8aeb0591b7f07f01b711c6c16c903c41af9b31235bbd5394b07ef54c81a026afdcdf9dd7fdeb18e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE
Filesize
416B

MD5
d91c0811e23ec64b43643442a89e9c2f

SHA1
d837d137ae524a526fd6f8de7651852b605ea0c6

SHA256
a6278b3d5567b5d67457ca50a29196127114e6c49cc7c211d17679e4b0092b5a

SHA512
8f34a5dae5deb9f14575993c373afd23a331182eaa422d29af8d0dacce440ca81bebd65e4f5b3e35978a8b8fc59d76de00b804f40fec39fece1978a5fed3431a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
727230d7b0f8df1633bc043529f5c15d

SHA1
5b24d959d4c5dcf8125125dbee37225d6160af18

SHA256
54961bcb62812886877fcd3ad3896891099cc4bddc51ea6f07a606cf5124d998

SHA512
35735f0dadf7ee69bcccd5e9120d6a55db39138eff58acbe4ea8116fb007c54a024028dccd5f25856ffcf33e1f3bdccfd8d0e2527130a16351debb04c27b8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
ea5229a79c30a0437027bdce20d1ba59

SHA1
6a1dc54a338009c9d89e2fd7bb908afc7bd88784

SHA256
172e0e91239669d8249cb98350e42c5ae397d5f5c67cdab3b71519180878ad65

SHA512
bb535fbbdd2df02a49d0388134a4b763f4694aa70c266bf94610fb9f10ebf144760c15a6c6989a52cf1e8d6c7d9be733a4bb2ac68414c579ee5b8b6dbf7365e6

Download Submit
\??\pipe\LOCAL\crashpad_2028_UEAZTVNQDLZBEECW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_2536_SVIZSHKSMSIVMJCS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/868-133-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/868-137-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1420-178-0x0000000000000000-mapping.dmp

Download
memory/2028-139-0x0000000000000000-mapping.dmp

Download
memory/2032-135-0x0000000000000000-mapping.dmp

Download
memory/2032-136-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2092-140-0x0000000000000000-mapping.dmp

Download
memory/2144-176-0x0000000000000000-mapping.dmp

Download
memory/2188-179-0x0000000000000000-mapping.dmp

Download
memory/2536-138-0x0000000000000000-mapping.dmp

Download
memory/2580-164-0x0000000000000000-mapping.dmp

Download
memory/3424-174-0x0000000000000000-mapping.dmp

Download
memory/3456-154-0x0000000000000000-mapping.dmp

Download
memory/3664-150-0x0000000000000000-mapping.dmp

Download
memory/3720-151-0x0000000000000000-mapping.dmp

Download
memory/3972-180-0x0000000000000000-mapping.dmp

Download
memory/4064-170-0x0000000000000000-mapping.dmp

Download
memory/4248-141-0x0000000000000000-mapping.dmp

Download
memory/4284-172-0x0000000000000000-mapping.dmp

Download
memory/4408-168-0x0000000000000000-mapping.dmp

Download
memory/4616-166-0x0000000000000000-mapping.dmp

Download
memory/4680-160-0x0000000000000000-mapping.dmp

Download
memory/4700-152-0x0000000000000000-mapping.dmp

Download
memory/4720-148-0x0000000000000000-mapping.dmp

Download
memory/5048-181-0x0000000000000000-mapping.dmp

Download