b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24

Analysis

max time kernel
144s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
Size

407KB
MD5

06392177fb86322b250e730563ad0b12
SHA1

af8888959e3d0edf9d69717664babc99ddaac859
SHA256

b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24
SHA512

7f17449ce1725a237afba7e6f53bb83c38a91edf9b0caeeb3e2782f92d25b1af4051f9051d5bc8a79779a6721c5c726cfa9717162155fe01207d7679860d3a0c
SSDEEP

6144:TkE8FSh4HT7d2PojIvSdBo9zMeBmwRiU3bPP0N1vbm6Hq12IYI:ZX/5a2d7iU3b0y1Z

Score

6^/10

microsoft persistence phishing

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221209122701.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\25150988-b232-4089-bbef-e9a29a3f7c9e.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
2740	msedge.exe
2740	msedge.exe
3416	identity_helper.exe
3416	identity_helper.exe
176	msedge.exe
176	msedge.exe
176	msedge.exe
176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5088 wrote to memory of 5072	5088	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	83
PID 5072 wrote to memory of 2740	5072	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	84
PID 5072 wrote to memory of 2740	5072	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	84
PID 2740 wrote to memory of 732	2740	msedge.exe	85
PID 2740 wrote to memory of 732	2740	msedge.exe	85
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 3260	2740	msedge.exe	88
PID 2740 wrote to memory of 4016	2740	msedge.exe	89
PID 2740 wrote to memory of 4016	2740	msedge.exe	89
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90
PID 2740 wrote to memory of 3656	2740	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
"C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
  C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Adds Run key to start application
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf62646f8,0x7ffdf6264708,0x7ffdf6264718
      4⤵
      PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4948 /prefetch:8
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6808 /prefetch:8
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ff79e955460,0x7ff79e955470,0x7ff79e955480
        5⤵
        
        PID:380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6808 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3152 /prefetch:8
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3188 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2164,10655094754329798279,17261784550835468515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 /prefetch:8
      4⤵
      PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffdf62646f8,0x7ffdf6264708,0x7ffdf6264718
      4⤵
      PID:2452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cc113cab81df2ff66421c3dd6bf4d31

SHA1
c1e1b1e2f007732c8c79eedac889b7312b08990e

SHA256
48438eda8d47a465f7aa67c36937ec174be450bea6b501e2fc1cc929c917e2ea

SHA512
e069f0cbd04f3fc91824df48f247e1542c6858cc3cf3dd4f16c26258beac2f7aa256bad6cdda3b2cef916afd186b269375a43013138fbc795f22c1367c799a2b

Download Submit
memory/5072-133-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download