c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
Size

548KB
MD5

5f2f7997119dd02598845d308fb6a192
SHA1

ff03f107c9fb06f019ccded3c4e5f89e9fd12d82
SHA256

c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57
SHA512

050fc68d9f91780031a3fd59872d9d823b4469db3fdd87482a3305c5fbca96ec0751a382973115abdff877dd477d8f65909c254d3b1820b847d16202305035ef
SSDEEP

12288:YR9yH6k71WH7GPk/lh1DWBJvJQouAPx9L+jr1abpmbcVNM8Ox:gMFQHh//VWBx+APmjr1UEcs8Ox

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4756	msedgerecovery.exe
4892	MicrosoftEdgeUpdateSetup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3324-132-0x0000000000400000-0x00000000005D9000-memory.dmp	upx
behavioral2/memory/3324-133-0x0000000000400000-0x00000000005D9000-memory.dmp	upx
behavioral2/memory/3324-136-0x0000000000400000-0x00000000005D9000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\MicrosoftEdgeUpdateSetup.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\msedgerecovery.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\msedgerecovery.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9e608536-4e9d-4ceb-b690-5f5bac627a10.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221210080817.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\recovery-component-inner.crx	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\MicrosoftEdgeUpdateSetup.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
2868	msedge.exe
2868	msedge.exe
3532	msedge.exe
3532	msedge.exe
1248	identity_helper.exe
1248	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 3532	3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe	81
PID 3324 wrote to memory of 3532	3324	c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe	81
PID 3532 wrote to memory of 2404	3532	msedge.exe	82
PID 3532 wrote to memory of 2404	3532	msedge.exe	82
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 632	3532	msedge.exe	85
PID 3532 wrote to memory of 2868	3532	msedge.exe	86
PID 3532 wrote to memory of 2868	3532	msedge.exe	86
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88
PID 3532 wrote to memory of 4356	3532	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe
"C:\Users\Admin\AppData\Local\Temp\c48d72641deb844c54239fc1e17f59b672aa7c2e3f6ad71f52d4fbb4cea44b57.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.cfxiaomi.com/?wg
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb90bb46f8,0x7ffb90bb4708,0x7ffb90bb4718
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5664 /prefetch:8
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6e88f5460,0x7ff6e88f5470,0x7ff6e88f5480
      4⤵
      PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5432 /prefetch:8
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1044 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,772566024361583827,17221441591454900011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1728 /prefetch:8
    3⤵
    PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\msedgerecovery.exe
  "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.67 --sessionid={1b6f4dc2-dce9-4d53-bafa-752fab6dd7f4} --system
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\MicrosoftEdgeUpdateSetup.exe
    "C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
    3⤵
    - Executes dropped EXE
    PID:4892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\MicrosoftEdgeUpdateSetup.exe

Filesize
1.5MB

MD5
f70962a7883fefe8defa224c1ffdadfa

SHA1
efd06b7c1b5ead8cec2cd029a8d8ccb0c46ee2da

SHA256
3e726854ff0a0046de458afc2cd58cfc37430b4c7969395111398f47d8f63bb4

SHA512
678c10874e6089acde5c57cdc64e11a76cbc9b3e7c882f9c1eaa619f897675c8f145e4be4825d8197edb2e645035a0953c3ed5a34da3e84d013fea5599699761

Download Submit
C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir4876_73727773\msedgerecovery.exe

Filesize
1.1MB

MD5
3b2bd3e2b22afa49576723c819a1185b

SHA1
41a1590e22600c717acd9e376b9020b3021dada6

SHA256
b2900c435244e948491cfab330b570b4326d1879c5c2be2aa35ce8bd49446d05

SHA512
a411b00da74a6c90d0a60a0d9a024a430c2c7483416dc95634bd62c5c29b9c9d1fd3310911f2da85df66aac08e9026df4aad00c083781ca22802b0236652d1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\1.3.169.31\recovery-component-inner.crx

Filesize
1.9MB

MD5
dcb0ab396e869708ca1ca663c6697b50

SHA1
83d2d79250a470d8c140259688ee35e6019c60f0

SHA256
083c44f154565469a742fe081b09ab19eb5f2a986936dbcef55ddd21f79e6beb

SHA512
e598653b4e6fa16f7ca3a96b44cc279fb010555102c3b661a88e44f6750242e43293a54af25c187445a6f65f7979d556285c16a0294530978f97327f8c1bdd68

Download Submit
memory/3324-133-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-132-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-136-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download