Analysis
-
max time kernel
299s -
max time network
284s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
16-01-2023 18:34
Behavioral task
behavioral1
Sample
Scan_34258_INV.pdf
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
Scan_34258_INV.pdf
Resource
win10v2004-20221111-en
General
-
Target
Scan_34258_INV.pdf
-
Size
111KB
-
MD5
7f29d2ee5c2f0420f7e086945fe6a45c
-
SHA1
815ccc940ca35fa43751e55d698b6f3f3afa8d99
-
SHA256
3a5491b70c66de97c835e8033d756761257947b934bcb6349fcd38175f184160
-
SHA512
558b8fd224f5c89c1f2d22c796fa16ad3cf45e6b37ccdf8186adeaaee78c8936dbd940242f25c0ab25ffb6aa8a011c89fa403b4f7447ccc7ef894014387a8684
-
SSDEEP
3072:bO+0kPS4/w4O2RSkx/XWEOOJ1nbR5aWYM:bFvwl2RS6OiRRKM
Malware Config
Signatures
-
Drops file in Windows directory 5 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2219095117.pri MicrosoftEdgeCP.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
Processes:
AcroRd32.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 7bef3f1b21bed801 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 604c53bd0b2ad901 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 27dfc472d929d901 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4cb5885ad929d901 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000b08d31a6b2b544e09209b5c0c5a996f170f5c92d668e57fc8f4f28f81d6879bb790aac45595f5201aaac94fbcce03f91d3f0b4ddfbbc3cbd6565a1c8e047b083340c61e6017a0439b4fc8af3ad639b6c4b4cbbfbc6c244bfad53 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 7bef3f1b21bed801 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "y0z1z5v" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 7bef3f1b21bed801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 48a44f5ad929d901 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{046A9074-D9E2-41C0-8CA2-B7CF82FE339B}" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AcroRd32.exepid process 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
MicrosoftEdgeCP.exepid process 1948 MicrosoftEdgeCP.exe 1948 MicrosoftEdgeCP.exe 1948 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 952 MicrosoftEdge.exe Token: SeDebugPrivilege 952 MicrosoftEdge.exe Token: SeDebugPrivilege 952 MicrosoftEdge.exe Token: SeDebugPrivilege 952 MicrosoftEdge.exe Token: SeDebugPrivilege 216 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 216 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 216 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 216 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1840 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1840 MicrosoftEdgeCP.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 4760 AcroRd32.exe -
Suspicious use of SendNotifyMessage 14 IoCs
Processes:
AcroRd32.exepid process 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
AcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 4760 AcroRd32.exe 952 MicrosoftEdge.exe 1948 MicrosoftEdgeCP.exe 1948 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 4760 wrote to memory of 2244 4760 AcroRd32.exe RdrCEF.exe PID 4760 wrote to memory of 2244 4760 AcroRd32.exe RdrCEF.exe PID 4760 wrote to memory of 2244 4760 AcroRd32.exe RdrCEF.exe PID 4760 wrote to memory of 5112 4760 AcroRd32.exe RdrCEF.exe PID 4760 wrote to memory of 5112 4760 AcroRd32.exe RdrCEF.exe PID 4760 wrote to memory of 5112 4760 AcroRd32.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 3756 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe PID 2244 wrote to memory of 1392 2244 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Scan_34258_INV.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=03D4BBDA6A34560EA635169758FD6DA1 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B82BB37DFA2F70C019DDFAFBF329A176 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B82BB37DFA2F70C019DDFAFBF329A176 --renderer-client-id=2 --mojo-platform-channel-handle=1676 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EF9FD55F0B71B59E9F55E9B4E7B7008A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EF9FD55F0B71B59E9F55E9B4E7B7008A --renderer-client-id=4 --mojo-platform-channel-handle=1988 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=090A156C4DC925F57C0D721DE5E17F8C --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6B156673057CAD62DAB84EB3A2E2E584 --mojo-platform-channel-handle=2664 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A18A2A57770435DF11BF23A43DC2ED2 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://firebasestorage.googleapis.com/v0/b/nodal-alcove-372422.appspot.com/o/t7RafwvTz0%2FDocument-1705.zip?alt=media&token=ba73aaaf-d25d-4889-aff9-ba76c8c8ba53"2⤵
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://firebasestorage.googleapis.com/v0/b/nodal-alcove-372422.appspot.com/o/t7RafwvTz0%2FDocument-1705.zip?alt=media&token=ba73aaaf-d25d-4889-aff9-ba76c8c8ba53"2⤵
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://firebasestorage.googleapis.com/v0/b/nodal-alcove-372422.appspot.com/o/t7RafwvTz0%2FDocument-1705.zip?alt=media&token=ba73aaaf-d25d-4889-aff9-ba76c8c8ba53"2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\6S6EGK4L\Document-1705[1].zipFilesize
141KB
MD54bcb64e0b30589fc4d5ef6816c6631b2
SHA139e1a13467553ac1b25e23632bd8f1c75475f566
SHA2560ae53ae81dd57121daf115115b4334b3ce86c2cfe0db8e7fa2c74b6a9f989bf6
SHA5121746f76473ac3a68e1156b15a66680b133e126089cad194c712ee880972663768255c0c1895291e5fb6f8bfff7f23d4708313501f0507090d8ad8fd414a6b2fb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\O479MC43\Document-1705[1].zipFilesize
141KB
MD54bcb64e0b30589fc4d5ef6816c6631b2
SHA139e1a13467553ac1b25e23632bd8f1c75475f566
SHA2560ae53ae81dd57121daf115115b4334b3ce86c2cfe0db8e7fa2c74b6a9f989bf6
SHA5121746f76473ac3a68e1156b15a66680b133e126089cad194c712ee880972663768255c0c1895291e5fb6f8bfff7f23d4708313501f0507090d8ad8fd414a6b2fb
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5e727b2cf156926693289adf5c9c2d616
SHA1cae23fcb60c1e397666404c852835988ead7d7a6
SHA256d482f13b320f89cebf9478dc19a81f1bebd109e65e79b22bb056466f819db7a5
SHA5126f1b3cf0d3a2ab56ad76b58dde97d230c7d533940f0380f3379630c9a12f7114e5a599c83ecccc823c025cd1aaafbb326d6246b7e307ed923fa380fa38eea0f6
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1Filesize
471B
MD51b2e51abfd12507b00ebd8b7afda6308
SHA14d3d5fa49e007714dd37da7da25d9d490d05bd0a
SHA25685a04d4cf987fcc2d087ab815a8d373e164a2adf2bf478e7a5c1fae3e109ba26
SHA5123c1056abf3c3110bec887e716094c73ca4db5eb6a818009cf1e9649abb4e8141a7499e3699e5909421a2f85859c7e811416f5cac9b65defa19cb1d66604855e3
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
724B
MD5f569e1d183b84e8078dc456192127536
SHA130c537463eed902925300dd07a87d820a713753f
SHA256287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413
SHA51249553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5cb486eb18d8de33b4ca3c619e2afdf38
SHA1f80769288a0298dfcb3df87a99ef4fd61cab7ea8
SHA256f7200fe992b95affbf96e22631e3613d27a8e7a170a37c821449c3505b8e1ba5
SHA5122a329ffe0a0a87701db911cd98c641c8eb06e6032426c6baa7b7266dbec0a8aa8278249197475b57061bee625929bb9208cc8126b11031a6275bfc340b398151
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5cb486eb18d8de33b4ca3c619e2afdf38
SHA1f80769288a0298dfcb3df87a99ef4fd61cab7ea8
SHA256f7200fe992b95affbf96e22631e3613d27a8e7a170a37c821449c3505b8e1ba5
SHA5122a329ffe0a0a87701db911cd98c641c8eb06e6032426c6baa7b7266dbec0a8aa8278249197475b57061bee625929bb9208cc8126b11031a6275bfc340b398151
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1Filesize
406B
MD541b917ce11da9746955894487966fc9f
SHA1353a431c60cc9d5144597ec2e9e01ff3448a41eb
SHA256a97ed7dd310cfcdee2c26174af406bf01b8ed711ec797e67cec49ed356a3677d
SHA51239510001aaa58c05f5f11919df472ae81a4d8bc2df056d7039394e9d2056e626f7397f948a8dfb89ea1797a620feaa2a6b001e94b49404db2c44b044f2195ebf
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A53B1AB43B3D351517A14F4A651C94F1Filesize
406B
MD52871661815985c3f888bb10be598bca9
SHA10ae9afaebc4e9226c2fef88509a7a63f6fd7daab
SHA25620a508df05fd06c9d9472cf3e93bc3402720cee2bc1f9fc28577d2270a7c876d
SHA5125d9af8b56da640f16fc5de031ea566408fbef4877b6104fbcea56b537dec85b6eb8aebf95aa0e2ad9d737406a07133f0c25b8d6e39334b200b0fd6679c2cae18
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD568fb5ff4563eb8250af69c68db25e196
SHA1d81eed733b623f632154f5384a361f201711c0d3
SHA2564bc309b052f60cb64793d1576fad8b5d528870918ffe89370ccd87db987a5774
SHA5123019201a63162d412e423c067fac84919b7720cbef4435a47797dd34f915b5005890a7c2b72692c9211d6152a2fa0666d5e6e626b558186ca5bf2b77a595685b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAFilesize
392B
MD568fb5ff4563eb8250af69c68db25e196
SHA1d81eed733b623f632154f5384a361f201711c0d3
SHA2564bc309b052f60cb64793d1576fad8b5d528870918ffe89370ccd87db987a5774
SHA5123019201a63162d412e423c067fac84919b7720cbef4435a47797dd34f915b5005890a7c2b72692c9211d6152a2fa0666d5e6e626b558186ca5bf2b77a595685b
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.priFilesize
207KB
MD5e2b88765ee31470114e866d939a8f2c6
SHA1e0a53b8511186ff308a0507b6304fb16cabd4e1f
SHA256523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e
SHA512462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d
-
memory/1320-814-0x0000000000000000-mapping.dmp
-
memory/1392-371-0x0000000000000000-mapping.dmp
-
memory/1744-921-0x0000000000000000-mapping.dmp
-
memory/2148-399-0x0000000000000000-mapping.dmp
-
memory/2244-207-0x0000000000000000-mapping.dmp
-
memory/2732-487-0x0000000000000000-mapping.dmp
-
memory/3612-1129-0x0000000000000000-mapping.dmp
-
memory/3736-658-0x0000000000000000-mapping.dmp
-
memory/3756-337-0x0000000000000000-mapping.dmp
-
memory/4196-1024-0x0000000000000000-mapping.dmp
-
memory/4760-143-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-175-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-151-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-153-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-156-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-159-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-162-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-163-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-165-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-164-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-161-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-160-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-158-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-157-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-155-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-154-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-152-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-150-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-148-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-145-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-120-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-139-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-135-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-131-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-166-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-167-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-168-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-169-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-170-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-171-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-172-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-173-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-174-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-149-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-176-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-177-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-178-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-179-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-180-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-181-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-182-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-183-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-147-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-121-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-146-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-144-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-142-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-141-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-140-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-138-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-137-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-136-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-134-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-133-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-132-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-129-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-130-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-128-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-126-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-127-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-125-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-124-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-123-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4760-122-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/5112-313-0x0000000000000000-mapping.dmp