858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
Size

435KB
MD5

dde59803ad21998c769f45975bc028eb
SHA1

058b4c801773d6acd2e1a4a4d2fc51698090d05f
SHA256

858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3
SHA512

fc1debe4b2648c5f08d9ca5f2ab212009f847681cb6c0a37953806bec981869687f12b0e697305a526b1ba984309335fee56f19419fbc94cd5282d6141ce3171
SSDEEP

12288:gG4vQqF148+hgIWOMaAto70A1BbZq9kl4M:mr42KMaxp16M

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000022e03-133.dat	aspack_v212_v242
behavioral2/files/0x0007000000022e03-134.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1484	Isass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022e03-133.dat	upx
behavioral2/files/0x0007000000022e03-134.dat	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Isass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\irwftp = "C:\\windows\\system\\Isass.exe"	Isass.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8c6cc033-c69b-4117-b855-b161b2991577.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221206114521.pma	setup.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Filespro\Sales\Local\teclado_CX.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela2_BB.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\barra_progress.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\campo_CX.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\caps.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\err_bb.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\logoPF.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\senha_AMARELA.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela_Bradesco_senha.zip	Isass.exe
File created	C:\Windows\winnavps\bbb.bck	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\topo2.bmp	Isass.exe
File created	C:\Windows\System\Isass.exe	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\System\cartao.html	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\Filespro\Sales\Local\barra2-PROGRESS.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\senha_GER.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela_caixa_assinatura.zip	Isass.exe
File opened for modification	C:\Windows\System\cartao.html	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\Filespro\Sales\Local\barra_brad.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\bt_confirma.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\tela_brad_sencartao.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\TV_PJ.zip	Isass.exe
File opened for modification	C:\Windows\System\Isass.exe	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
File created	C:\Windows\Filespro\Sales\Local\topo2.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\bt_retornaCX.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\cadeado.zip	Isass.exe
File created	C:\Windows\Filespro\Sales\Local\logo_BB.zip	Isass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1636	identity_helper.exe
1636	identity_helper.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1484	Isass.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe
1900	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1900	msedge.exe
1900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1484	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	79
PID 2188 wrote to memory of 1484	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	79
PID 2188 wrote to memory of 1484	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	79
PID 2188 wrote to memory of 1900	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	80
PID 2188 wrote to memory of 1900	2188	858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe	80
PID 1900 wrote to memory of 5032	1900	msedge.exe	81
PID 1900 wrote to memory of 5032	1900	msedge.exe	81
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 2032	1900	msedge.exe	84
PID 1900 wrote to memory of 4044	1900	msedge.exe	85
PID 1900 wrote to memory of 4044	1900	msedge.exe	85
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86
PID 1900 wrote to memory of 208	1900	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe
"C:\Users\Admin\AppData\Local\Temp\858887b380596f12cbe30e3392b88ce7f8a9db25955034d94ec2a772d9a01ab3.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2188
- C:\windows\system\Isass.exe
  "C:\windows\system\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\windows\system\cartao.html
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x9c,0x104,0x7ffea72846f8,0x7ffea7284708,0x7ffea7284718
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3748 /prefetch:8
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    PID:1916
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6703e5460,0x7ff6703e5470,0x7ff6703e5480
      4⤵
      PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3172 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2108,12399529067528376944,5018938095286264315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1868 /prefetch:8
    3⤵
    PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
1KB

MD5
673ebc6bd420c2311ed712deafc5e744

SHA1
e9e737ca005e7f5d2fe22633e50b8d954b7060ee

SHA256
7e2c61c3a97760bb147863ef5b32476e7ad40281c49f88f96b626987cf87daa8

SHA512
02a57157ce464daed8b83c4dd3eb42eddc8851a1c4a5997b44c11eb24ebbfd119bd11e3aad31187cfc1d693d920dcc78d10593b98264e06a4d79ffe39046d35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
1KB

MD5
61a43ad7b5e0efb0fd2a3468d3d3ec4a

SHA1
549e5ea79d18c1443df8e33e06767c6743303c66

SHA256
0e01a5872ad78b80cd0dbd9f4a68b0b7578e1b2cb4c335a48fe6e3b906b8228f

SHA512
66c624ed2713fbd406d793de16c041048f6fa8ebe6888cf694311801037cc3f41ee21916a21c8ae4756db507a641166b7544901f245a05d1d110a82e72fa5523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
eaa4dce3eae1609f49ebae7323d80fef

SHA1
268d51e298f71353410a48e4ae2c3d9ba3e0b09b

SHA256
df398498ccd10951e5b64a54a0d10547e36a78d1cbca6369ee8aabc83363ad83

SHA512
132bafb53cca8aa087ecdf4c8b1432ff3a434412360a6bdec513add2c4417117fea4c02544cf914a3ba8f27893ced13ca883014d61258c5e11bd607d9a4a6946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
0cefad0d28f8c24aa862f5ade2c88ad6

SHA1
7c8c32cb51c2de0c36f7d315072bc0fd87d6d274

SHA256
66cad833409ac2299dda70ff1d260078975593ce03ea577e4c4e30b21418c08e

SHA512
32fbdc8b3ff4ee9326116130c891e239828355160cbb261b90bfcb9b4681df8651cc13d6cd9ce19c48ea2adb12dc3c03fd04636a037d639e33e230d4fcd6f3e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4F

Filesize
442B

MD5
b368095523cf31ae6f3bd42f275ea232

SHA1
de4c40139bb9de098851e0adbdc6d9d477fca338

SHA256
572ca0024186421d3328ad028d52f2f51f506aea7257f0e12561553499a827a4

SHA512
62202f3f2dc8f518f30867df6221d128004faf29241252a1765a1c40c3816c26fdd4f417a436cb5da1ffa106296344e4176c76e1521aadf7c0ea6b47d29cc31d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
d9dfd3d77eba6accaec861899617076d

SHA1
15558bb563b05c28563319dfa8aac2dc89032915

SHA256
3fa82ff32d96673b2ac40f96486943ea8891fb2157c5e247cbe41a23faf9d989

SHA512
8b154e4ebb1815ae10f3a0fb03fcf972a31af39842d1278387714491e3cf3d91bc7f271753bb79d25354fc4bce9ba1faa28aa5d7c00c5263f625d06c93d83345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
03bcae83e9fc33590305cad5ac5763db

SHA1
2526f80c4d8cef8d775fba4ae855d92de5fe241b

SHA256
cc96350f779391cfa6d80aa9ed49d7f8710a2b807b542781d2582f210feb5047

SHA512
b4934d80be9b84e32bc8086f2d718b22bb14a55fb4f4c8fa5423827dd01f0dc6ba003c42193a197ac51c51086e1d356f61c833e9ce79928a633e77e6fc38eb63

Download Submit
C:\Windows\System\Isass.exe

Filesize
374KB

MD5
8e84e918828c24aa20163f099802eda1

SHA1
db2a492e3b1cd9f137bdb8567578e5116b321342

SHA256
db7a049e95a848a3b54d53c751803950cd20ce4185bd2ad30bc3d6003eefcd93

SHA512
68af9f490973adb8a7020c9bc2e622aa38bfd6503d5c2a6978e6d27e976f966bb6aa70bdd3ae4912c1e1046fb5357a24e5aaf5c0069dff5351c8e81638591135

Download Submit
C:\windows\system\Isass.exe

Filesize
374KB

MD5
8e84e918828c24aa20163f099802eda1

SHA1
db2a492e3b1cd9f137bdb8567578e5116b321342

SHA256
db7a049e95a848a3b54d53c751803950cd20ce4185bd2ad30bc3d6003eefcd93

SHA512
68af9f490973adb8a7020c9bc2e622aa38bfd6503d5c2a6978e6d27e976f966bb6aa70bdd3ae4912c1e1046fb5357a24e5aaf5c0069dff5351c8e81638591135

Download Submit
C:\windows\system\cartao.html

Filesize
68B

MD5
2152787342b7e99c8c6adc6a2430183c

SHA1
f9a8dab3a4a08fe6af0eadcef06747cbd9c5dc11

SHA256
fcd6ab594cf573d80609fb22ed43db08607c32da469ce930f783668b25146775

SHA512
83489261f15bc9f2352a9246686cf2a091d078d90344975acaac1658743b9a5176ab36b53bbba04c1a75dd1fb6076c029cc723111d0565bb940ec5ea0d0d9511

Download Submit