858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
Size 435KB
Sample221203-mqcfssfg41
SHA256 858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3
MD5 dde59803ad21998c769f45975bc028eb
SHA1 058b4c801773d6acd2e1a4a4d2fc51698090d05f
SHA512 fc1debe4b2648c5f08d9ca5f2ab212009f847681cb6c0a37953806bec981869687f12b0e697305a526b1ba984309335fee56f19419fbc94cd5282d6141ce3171
SSDEEP 12288:gG4vQqF148+hgIWOMaAto70A1BbZq9kl4M:mr42KMaxp16M
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000022e03-133.dat	aspack_v212_v242
behavioral2/files/0x0007000000022e03-134.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1484	Isass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022e03-133.dat	upx
behavioral2/files/0x0007000000022e03-134.dat	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Isass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\irwftp = "C:\\windows\\system\\Isass.exe"	Isass.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8c6cc033-c69b-4117-b855-b161b2991577.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221206114521.pma	setup.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Filespro\Sales\Local\teclado_CX.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela2_BB.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\barra_progress.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\campo_CX.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\caps.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\err_bb.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\logoPF.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\senha_AMARELA.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela_Bradesco_senha.zip	Isass.exe
File created	C:\Windows\winnavps\bbb.bck	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\topo2.bmp	Isass.exe
File created	C:\Windows\System\Isass.exe	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\System\cartao.html	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\Filespro\Sales\Local\barra2-PROGRESS.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\senha_GER.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela_caixa_assinatura.zip	Isass.exe
File opened for modification	C:\Windows\System\cartao.html	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\Filespro\Sales\Local\barra_brad.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\bt_confirma.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela_brad_sencartao.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\TV_PJ.zip	Isass.exe
File opened for modification	C:\Windows\System\Isass.exe	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\Filespro\Sales\Local\topo2.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\bt_retornaCX.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\cadeado.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\logo_BB.zip	Isass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1636	identity_helper.exe
1636	identity_helper.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1484	Isass.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1484	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	79
PID 2188 wrote to memory of 1484	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	79
PID 2188 wrote to memory of 1484	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	79
PID 2188 wrote to memory of 1900	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	80
PID 2188 wrote to memory of 1900	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	80
PID 1900 wrote to memory of 5032	1900	msedge.exe	81
PID 1900 wrote to memory of 5032	1900	msedge.exe	81
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 4044	1900	msedge.exe	85
PID 1900 wrote to memory of 4044	1900	msedge.exe	85
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
"C:\Users\Admin\AppData\Local\Temp\858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2188
- C:\windows\system\Isass.exe
  "C:\windows\system\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\windows\system\cartao.html
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x9c,0x104,0x7ffea72846f8,0x7ffea7284708,0x7ffea7284718
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3748 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6703e5460,0x7ff6703e5470,0x7ff6703e5480
      4⤵
      PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3172 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1868 /prefetch:8
    3⤵
    PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F
Size 1KB
SHA256 7e2c61c3a97760bb147863ef5b32476e7ad40281c49f88f96b626987cf87daa8
MD5 673ebc6bd420c2311ed712deafc5e744
SHA1 e9e737ca005e7f5d2fe22633e50b8d954b7060ee
SHA512 02a57157ce464daed8b83c4dd3eb42eddc8851a1c4a5997b44c11eb24ebbfd119bd11e3aad31187cfc1d693d920dcc78d10593b98264e06a4d79ffe39046d35f
MD5 SHA1 SHA512

Submit Download

B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Size 1KB
SHA256 0e01a5872ad78b80cd0dbd9f4a68b0b7578e1b2cb4c335a48fe6e3b906b8228f
MD5 61a43ad7b5e0efb0fd2a3468d3d3ec4a
SHA1 549e5ea79d18c1443df8e33e06767c6743303c66
SHA512 66c624ed2713fbd406d793de16c041048f6fa8ebe6888cf694311801037cc3f41ee21916a21c8ae4756db507a641166b7544901f245a05d1d110a82e72fa5523
MD5 SHA1 SHA512

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 df398498ccd10951e5b64a54a0d10547e36a78d1cbca6369ee8aabc83363ad83
MD5 eaa4dce3eae1609f49ebae7323d80fef
SHA1 268d51e298f71353410a48e4ae2c3d9ba3e0b09b
SHA512 132bafb53cca8aa087ecdf4c8b1432ff3a434412360a6bdec513add2c4417117fea4c02544cf914a3ba8f27893ced13ca883014d61258c5e11bd607d9a4a6946
MD5 SHA1 SHA512

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 340B
SHA256 66cad833409ac2299dda70ff1d260078975593ce03ea577e4c4e30b21418c08e
MD5 0cefad0d28f8c24aa862f5ade2c88ad6
SHA1 7c8c32cb51c2de0c36f7d315072bc0fd87d6d274
SHA512 32fbdc8b3ff4ee9326116130c891e239828355160cbb261b90bfcb9b4681df8651cc13d6cd9ce19c48ea2adb12dc3c03fd04636a037d639e33e230d4fcd6f3e6
MD5 SHA1 SHA512

Submit Download

75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F
Size 442B
SHA256 572ca0024186421d3328ad028d52f2f51f506aea7257f0e12561553499a827a4
MD5 b368095523cf31ae6f3bd42f275ea232
SHA1 de4c40139bb9de098851e0adbdc6d9d477fca338
SHA512 62202f3f2dc8f518f30867df6221d128004faf29241252a1765a1c40c3816c26fdd4f417a436cb5da1ffa106296344e4176c76e1521aadf7c0ea6b47d29cc31d
MD5 SHA1 SHA512

Submit Download

B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
Size 458B
SHA256 3fa82ff32d96673b2ac40f96486943ea8891fb2157c5e247cbe41a23faf9d989
MD5 d9dfd3d77eba6accaec861899617076d
SHA1 15558bb563b05c28563319dfa8aac2dc89032915
SHA512 8b154e4ebb1815ae10f3a0fb03fcf972a31af39842d1278387714491e3cf3d91bc7f271753bb79d25354fc4bce9ba1faa28aa5d7c00c5263f625d06c93d83345
MD5 SHA1 SHA512

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 cc96350f779391cfa6d80aa9ed49d7f8710a2b807b542781d2582f210feb5047
MD5 03bcae83e9fc33590305cad5ac5763db
SHA1 2526f80c4d8cef8d775fba4ae855d92de5fe241b
SHA512 b4934d80be9b84e32bc8086f2d718b22bb14a55fb4f4c8fa5423827dd01f0dc6ba003c42193a197ac51c51086e1d356f61c833e9ce79928a633e77e6fc38eb63
MD5 SHA1 SHA512

Submit Download

Isass.exe

Path C:\Windows\System\Isass.exe
Size 374KB
SHA256 db7a049e95a848a3b54d53c751803950cd20ce4185bd2ad30bc3d6003eefcd93
MD5 8e84e918828c24aa20163f099802eda1
SHA1 db2a492e3b1cd9f137bdb8567578e5116b321342
SHA512 68af9f490973adb8a7020c9bc2e622aa38bfd6503d5c2a6978e6d27e976f966bb6aa70bdd3ae4912c1e1046fb5357a24e5aaf5c0069dff5351c8e81638591135
SSDEEP 6144:SdsyK0jHNGBKk661mLxumVjw7S9gItz4E0mQWuL9EAto8+Ox4BTasRPB+fILn4ZX:HyKvF108+HgIWEMaAtogCUs1BBkl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Isass.exe

Path C:\windows\system\Isass.exe
Size 374KB
SHA256 db7a049e95a848a3b54d53c751803950cd20ce4185bd2ad30bc3d6003eefcd93
MD5 8e84e918828c24aa20163f099802eda1
SHA1 db2a492e3b1cd9f137bdb8567578e5116b321342
SHA512 68af9f490973adb8a7020c9bc2e622aa38bfd6503d5c2a6978e6d27e976f966bb6aa70bdd3ae4912c1e1046fb5357a24e5aaf5c0069dff5351c8e81638591135
SSDEEP 6144:SdsyK0jHNGBKk661mLxumVjw7S9gItz4E0mQWuL9EAto8+Ox4BTasRPB+fILn4ZX:HyKvF108+HgIWEMaAtogCUs1BBkl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

cartao.html

Path C:\windows\system\cartao.html
Size 68B
SHA256 fcd6ab594cf573d80609fb22ed43db08607c32da469ce930f783668b25146775
MD5 2152787342b7e99c8c6adc6a2430183c
SHA1 f9a8dab3a4a08fe6af0eadcef06747cbd9c5dc11
SHA512 83489261f15bc9f2352a9246686cf2a091d078d90344975acaac1658743b9a5176ab36b53bbba04c1a75dd1fb6076c029cc723111d0565bb940ec5ea0d0d9511
MD5 SHA1 SHA512

Submit Download