b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exe
Size

550KB
MD5

5d2a4a24a827374ccb57e8a92585cbab
SHA1

1a645c3a2497e2de81e3e7ac3a9fadb2054a28db
SHA256

b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d
SHA512

2ece36b6baea34408a6a42642d7caa99f3363f62fccba0c4de1cfec034a7e42ceded44ebd78240bc95bf0ab83f77d6f120629897273df399f189dfb349c0a6f8
SSDEEP

12288:UhWNf7tuIBtuiz5ErPPGtr/ZhvGAJw8m0zCQoVMpztSMcfK5PnoRFyRUXs:U0R7tNui4PE3vtxPLTpztS3fKtoOyXs

Score

6^/10

microsoft persistence phishing

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe
Detected potential entity reuse from brand microsoft.
phishing microsoft

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\804fea12-f2a2-4407-baed-061efda0c075.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221204023139.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1412 msedge.exe
1412 msedge.exe
3276 msedge.exe
3276 msedge.exe
2720 msedge.exe
2720 msedge.exe
2720 msedge.exe
2720 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3276 msedge.exe
3276 msedge.exe
3276 msedge.exe
3276 msedge.exe
3276 msedge.exe
3276 msedge.exe
3276 msedge.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

3276 msedge.exe
3276 msedge.exe
3276 msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

pid	process
1412	msedge.exe
1412	msedge.exe
3276	msedge.exe
3276	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

pid	process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

pid	process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exemsedge.exe

description	pid	process	target process
PID 4020 wrote to memory of 3276	4020	b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exe	msedge.exe
PID 4020 wrote to memory of 3276	4020	b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exe	msedge.exe
PID 3276 wrote to memory of 2568	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 2568	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1492	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1412	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 1412	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe
PID 3276 wrote to memory of 364	3276	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exe
"C:\Users\Admin\AppData\Local\Temp\b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe826a46f8,0x7ffe826a4708,0x7ffe826a4718
3⤵
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
3⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
3⤵
PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
3⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
3⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2680 /prefetch:8
3⤵
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
3⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
3⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
3⤵
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3512 /prefetch:8
3⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1
3⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
3⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1787618215907907093,13378150680353360537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6972 /prefetch:8
3⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
3⤵
- Drops file in Program Files directory
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff75c335460,0x7ff75c335470,0x7ff75c335480
4⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b20f8a6ceddde83da6394f330c9032931a36a758382f16b3f2c5299e465ca79d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe826a46f8,0x7ffe826a4708,0x7ffe826a4718
3⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16763286359075033674,3576074661018992891,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
3⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16763286359075033674,3576074661018992891,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
3⤵
PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
471B

MD5
8d691d89f635459b718316ca148ea5d7

SHA1
09026de7ca741cd94e55913a4d428d72cbbeadda

SHA256
d51d55a8bffb116709816d4c6223230e6c1dc19f3bfa656798ff7775432fb8ce

SHA512
ba9ed21071ed414f5cd23372e375c3e0e9d68f8330acfbc4dbc7255cbc7c6f614eb0bd5ab00ddb6034a6741f6b3f19691e024f007c347bd3e32e34a6184deb68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

Filesize
442B

MD5
21f9258413f6d4909f1def690beb37f9

SHA1
efd979af352e29f47d122c135f5855a7d82f62e4

SHA256
7d98870e583e1cb6edf5515a03d2c3bd825f8031ba19c16ca214bcaed22929e6

SHA512
cb1d777fb655bd8bafde1e2f93164f5b0b5a4f7968071f9b14a019d47d67e4788a3aaeaa62bce40aed58f8a6885d69b03c9331f45f68ef8ce9c80a65fdf797ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
71b657795f1d63721f304fcf46915016

SHA1
d2cabf753a2b8888642a3a26878e7f47784153b2

SHA256
f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

SHA512
dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9227ba18e4106970788586689f7dddd7

SHA1
7e2c112b4b2f2fe7b5d308a2078dc487f8b50c7c

SHA256
01d0339bd0406e76af6bbce8ca4e41d6c0bb5e1ac9f5926f1e0627590880e481

SHA512
b0fafe3d9e1e5d7e8eb6ba258852ae1d1c9ffb04a6378703755a89e4575d3af1c2b88e5367e0868b7f1ea3ee7f9a76a1541a2846e583621ed495d1d97ff864da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
f2c3f35b74c3629184382ca4249b9d81

SHA1
40fb24b2ef4a3b4d76128ee4107d46140f7f5fc9

SHA256
b0cc6fc1cd940e3ee48861a7745a55c8218a1e729864d3ea8712d266a7294976

SHA512
4227f7fdd6ffed1b15b3279da785d95eebc2c5bfeffd1084db2bd8efdca0882d3eccffff235a27b723aa667badbe08d842b589d829ca21b247b5dae6c6d3fe5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
f73c0f3fe902ee25b598d94b997f33dc

SHA1
07f8f9c0c82f764e0b3615cbd255460cf1fe14bc

SHA256
5a8b75eb2d14c1d2191ab1ece9856f61e531c191740df4251150baead1bbe1c9

SHA512
c98fefba77c2c7f6b8a80d2270c652c45faea6d97477ab54ebc13746cc63d14ae0ffc76a3ba1d5bb4d18a01b5a30bc92dff7e84da73facae40d8a7680302b2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings

Filesize
81B

MD5
f222079e71469c4d129b335b7c91355e

SHA1
0056c3003874efef229a5875742559c8c59887dc

SHA256
e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00

SHA512
e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Filesize
126KB

MD5
6698422bea0359f6d385a4d059c47301

SHA1
b1107d1f8cc1ef600531ed87cea1c41b7be474f6

SHA256
2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

SHA512
d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris

Filesize
40B

MD5
f9e6dfecf66b2bab20dd9c9f3d75e92c

SHA1
6830c69d2f9afd8a930d668b955e1da0e13b34dd

SHA256
d92caa42346a9f15230e07aac22d5e410606e8a62ec6815d4ad1a4a325a874f1

SHA512
befd325dd334bf9b41bd810cb9328da4f01268c0b53b811de1134e899a51bca6e3aac06694ef02dff09cc0853aecbd69d7e9785b0de93ff9f79bfc69f8cfd001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638057130523989064

Filesize
4KB

MD5
6b0725b473c3a3ac7c2fd02f98e89231

SHA1
04e259a2475d76852db95d6355b9f3322d7c33e4

SHA256
0065303c747ee955304f5a4ea85dd550e26ae9b70ceaef5e12a077782fa31bb5

SHA512
0a310ecab9e6610488be0f845cd5010b53a544470123c3c2d74045b40b09b680082bc1d1530ced12089ba401faa1c07c5bbef972f29bee268b00ea10cdb06d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic

Filesize
29B

MD5
52e2839549e67ce774547c9f07740500

SHA1
b172e16d7756483df0ca0a8d4f7640dd5d557201

SHA256
f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32

SHA512
d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982

Filesize
450KB

MD5
e9c502db957cdb977e7f5745b34c32e6

SHA1
dbd72b0d3f46fa35a9fe2527c25271aec08e3933

SHA256
5a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4

SHA512
b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca

Download Submit
\??\pipe\LOCAL\crashpad_2088_LUDUCSZOAWLQIAIA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_3276_FERYSMZEUVMOEKXF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/364-140-0x0000000000000000-mapping.dmp

Download
memory/1132-172-0x0000000000000000-mapping.dmp

Download
memory/1256-183-0x0000000000000000-mapping.dmp

Download
memory/1412-137-0x0000000000000000-mapping.dmp

Download
memory/1492-136-0x0000000000000000-mapping.dmp

Download
memory/1604-174-0x0000000000000000-mapping.dmp

Download
memory/1684-143-0x0000000000000000-mapping.dmp

Download
memory/1780-153-0x0000000000000000-mapping.dmp

Download
memory/2088-142-0x0000000000000000-mapping.dmp

Download
memory/2312-179-0x0000000000000000-mapping.dmp

Download
memory/2568-134-0x0000000000000000-mapping.dmp

Download
memory/2668-164-0x0000000000000000-mapping.dmp

Download
memory/2720-182-0x0000000000000000-mapping.dmp

Download
memory/2852-177-0x0000000000000000-mapping.dmp

Download
memory/3276-133-0x0000000000000000-mapping.dmp

Download
memory/3360-166-0x0000000000000000-mapping.dmp

Download
memory/3396-184-0x0000000000000000-mapping.dmp

Download
memory/3820-181-0x0000000000000000-mapping.dmp

Download
memory/4020-145-0x0000000052680000-0x0000000052730000-memory.dmp

Filesize
704KB

Download
memory/4020-132-0x0000000052680000-0x0000000052730000-memory.dmp

Filesize
704KB

Download
memory/4020-141-0x0000000052680000-0x0000000052730000-memory.dmp

Filesize
704KB

Download
memory/4340-148-0x0000000000000000-mapping.dmp

Download
memory/4392-165-0x0000000000000000-mapping.dmp

Download
memory/4540-150-0x0000000000000000-mapping.dmp

Download