0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da

General

Target

HermeticWiper.exe
Size

114KB
MD5

84ba0197920fd3e2b7dfa719fee09d2f
SHA1

912342f1c840a42f6b74132f8a7c4ffe7d40fb77
SHA256

0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da
SHA512

bbd4f0263abc71311404c55cb3e4711b707a71e28dcc1f08abd533a4c7f151db9cc40697105d76f1c978000e8fa7aa219adb65b31fb196b08f1ae003e04b9d23
SSDEEP

1536:lV3+WmNcWbwurilmw9BgjKu1sPPxaS5qY:lV3+WmjbwxlPwV1qPkS5qY

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

HermeticWiper.exe

description	ioc	process
File created	C:\Windows\system32\Drivers\ttdr	HermeticWiper.exe
File opened for modification	C:\Windows\system32\Drivers\ttdr	HermeticWiper.exe
File created	C:\Windows\system32\Drivers\ttdr.sys	HermeticWiper.exe

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEEXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEmsedge.exeEXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011612"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011612"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3905833577"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c974800000000020000000000106600000001000020000000000cb2f77e8a1c54c33317086313277bab0276b9eaccdadec9187ad4dac190f3000000000e800000000200002000000055d96dc9d6fe643c3be37c434eee966126f5950c9a78a62b0dafe516848c6ac020000000798db2ccb2590c9797ec317f18ec61b8566cc9ebb5067295cd4545d3ec4aac8d40000000f0efbebea9d6ea4564673ccba9ddebaa969dacc4d2dadbd298725001ab15821d5a7a00f162818a1a0231cec502017c674fb6e12eb22005da52a758953fa15d22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3905833577"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c974800000000020000000000106600000001000020000000680b1a632eb244863ea1c918595f6eb86645c54d88fb0cbd93ad7bbea830f515000000000e8000000002000020000000fadd3a5f6f2ed2744911b1fe0bd752fb48fb25a21f6e2dcc2b66f70f16da523620000000a7eb3d91e49928e2f8f129160b3d80cbd9000fdaeb28fc1e655b3fdcfbf7ed5d4000000059400026b3c5f07359c734917c1419e9fc777ee66782f9a5212750951e4ce2aabfd8ec46c9fb849d667c1a1045bfb86e2eb3f00529fca46d71eb1cf8cc17e0f1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907658e91c33d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ce66e91c33d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{13E35E8E-9F10-11ED-919F-5EDCA19B148A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE

Modifies registry class 2 IoCs

Processes:

OpenWith.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

WINWORD.EXEEXCEL.EXE

pid process

4796 WINWORD.EXE
4796 WINWORD.EXE
2324 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

2448 msedge.exe
2448 msedge.exe
2988 msedge.exe
2988 msedge.exe
Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

656
656
656
656
656
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2988 msedge.exe
2988 msedge.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

HermeticWiper.exe

description pid process

Token: 0 4336 HermeticWiper.exe
Token: SeBackupPrivilege 4336 HermeticWiper.exe
Token: SeLoadDriverPrivilege 4336 HermeticWiper.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exemsedge.exe

pid process

4800 iexplore.exe
2988 msedge.exe
2988 msedge.exe
2988 msedge.exe
2988 msedge.exe

pid	process
4796	WINWORD.EXE
4796	WINWORD.EXE
2324	EXCEL.EXE

pid	process
2448	msedge.exe
2448	msedge.exe
2988	msedge.exe
2988	msedge.exe

pid	process
656
656
656
656
656

pid	process
2988	msedge.exe
2988	msedge.exe

description	pid	process
Token: 0	4336	HermeticWiper.exe
Token: SeBackupPrivilege	4336	HermeticWiper.exe
Token: SeLoadDriverPrivilege	4336	HermeticWiper.exe

pid	process
4800	iexplore.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of SetWindowsHookEx 33 IoCs

Processes:

OpenWith.exeiexplore.exeIEXPLORE.EXEWINWORD.EXEEXCEL.EXE

pid	process
1484	OpenWith.exe
1484	OpenWith.exe
1484	OpenWith.exe
4800	iexplore.exe
4800	iexplore.exe
636	IEXPLORE.EXE
636	IEXPLORE.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
4796	WINWORD.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE
2324	EXCEL.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exemsedge.exe

description	pid	process	target process
PID 4800 wrote to memory of 636	4800	iexplore.exe	IEXPLORE.EXE
PID 4800 wrote to memory of 636	4800	iexplore.exe	IEXPLORE.EXE
PID 4800 wrote to memory of 636	4800	iexplore.exe	IEXPLORE.EXE
PID 2988 wrote to memory of 792	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 792	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1904	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 2448	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 2448	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe
PID 2988 wrote to memory of 1972	2988	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\HermeticWiper.exe
"C:\Users\Admin\AppData\Local\Temp\HermeticWiper.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ExportRevoke.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4800 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:636

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SwitchUndo.odt"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\CompressUninstall.svg
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd0,0xfc,0x120,0x40,0x124,0x7ffd38d246f8,0x7ffd38d24708,0x7ffd38d24718
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\DismountStart.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\pipe\LOCAL\crashpad_2988_MDBTKMJBMTYYZGMB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/792-144-0x0000000000000000-mapping.dmp

Download
memory/1904-146-0x0000000000000000-mapping.dmp

Download
memory/1908-158-0x0000000000000000-mapping.dmp

Download
memory/1972-150-0x0000000000000000-mapping.dmp

Download
memory/2324-160-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-159-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-170-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-169-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-168-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-167-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-165-0x00007FFD16840000-0x00007FFD16850000-memory.dmp

Filesize
64KB

Download
memory/2324-164-0x00007FFD16840000-0x00007FFD16850000-memory.dmp

Filesize
64KB

Download
memory/2324-163-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-162-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2324-161-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/2448-147-0x0000000000000000-mapping.dmp

Download
memory/3988-156-0x0000000000000000-mapping.dmp

Download
memory/4040-152-0x0000000000000000-mapping.dmp

Download
memory/4796-135-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-132-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-133-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-134-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-138-0x00007FFD16840000-0x00007FFD16850000-memory.dmp

Filesize
64KB

Download
memory/4796-136-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-137-0x00007FFD16840000-0x00007FFD16850000-memory.dmp

Filesize
64KB

Download
memory/4796-143-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-142-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-141-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4796-140-0x00007FFD189F0000-0x00007FFD18A00000-memory.dmp

Filesize
64KB

Download
memory/4976-154-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads