Analysis
-
max time kernel
126s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2023 12:31
Behavioral task
behavioral1
Sample
HermeticWiper.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
1800 seconds
General
-
Target
HermeticWiper.exe
-
Size
114KB
-
MD5
84ba0197920fd3e2b7dfa719fee09d2f
-
SHA1
912342f1c840a42f6b74132f8a7c4ffe7d40fb77
-
SHA256
0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da
-
SHA512
bbd4f0263abc71311404c55cb3e4711b707a71e28dcc1f08abd533a4c7f151db9cc40697105d76f1c978000e8fa7aa219adb65b31fb196b08f1ae003e04b9d23
-
SSDEEP
1536:lV3+WmNcWbwurilmw9BgjKu1sPPxaS5qY:lV3+WmjbwxlPwV1qPkS5qY
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\system32\Drivers\ttdr HermeticWiper.exe File opened for modification C:\Windows\system32\Drivers\ttdr HermeticWiper.exe File created C:\Windows\system32\Drivers\ttdr.sys HermeticWiper.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011612" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011612" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3905833577" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c974800000000020000000000106600000001000020000000000cb2f77e8a1c54c33317086313277bab0276b9eaccdadec9187ad4dac190f3000000000e800000000200002000000055d96dc9d6fe643c3be37c434eee966126f5950c9a78a62b0dafe516848c6ac020000000798db2ccb2590c9797ec317f18ec61b8566cc9ebb5067295cd4545d3ec4aac8d40000000f0efbebea9d6ea4564673ccba9ddebaa969dacc4d2dadbd298725001ab15821d5a7a00f162818a1a0231cec502017c674fb6e12eb22005da52a758953fa15d22 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3905833577" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c974800000000020000000000106600000001000020000000680b1a632eb244863ea1c918595f6eb86645c54d88fb0cbd93ad7bbea830f515000000000e8000000002000020000000fadd3a5f6f2ed2744911b1fe0bd752fb48fb25a21f6e2dcc2b66f70f16da523620000000a7eb3d91e49928e2f8f129160b3d80cbd9000fdaeb28fc1e655b3fdcfbf7ed5d4000000059400026b3c5f07359c734917c1419e9fc777ee66782f9a5212750951e4ce2aabfd8ec46c9fb849d667c1a1045bfb86e2eb3f00529fca46d71eb1cf8cc17e0f1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907658e91c33d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ce66e91c33d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{13E35E8E-9F10-11ED-919F-5EDCA19B148A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 4796 WINWORD.EXE 4796 WINWORD.EXE 2324 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2448 msedge.exe 2448 msedge.exe 2988 msedge.exe 2988 msedge.exe -
Suspicious behavior: LoadsDriver 5 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2988 msedge.exe 2988 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 0 4336 HermeticWiper.exe Token: SeBackupPrivilege 4336 HermeticWiper.exe Token: SeLoadDriverPrivilege 4336 HermeticWiper.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4800 iexplore.exe 2988 msedge.exe 2988 msedge.exe 2988 msedge.exe 2988 msedge.exe -
Suspicious use of SetWindowsHookEx 33 IoCs
pid Process 1484 OpenWith.exe 1484 OpenWith.exe 1484 OpenWith.exe 4800 iexplore.exe 4800 iexplore.exe 636 IEXPLORE.EXE 636 IEXPLORE.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 4796 WINWORD.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE 2324 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 636 4800 iexplore.exe 92 PID 4800 wrote to memory of 636 4800 iexplore.exe 92 PID 4800 wrote to memory of 636 4800 iexplore.exe 92 PID 2988 wrote to memory of 792 2988 msedge.exe 96 PID 2988 wrote to memory of 792 2988 msedge.exe 96 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 1904 2988 msedge.exe 97 PID 2988 wrote to memory of 2448 2988 msedge.exe 98 PID 2988 wrote to memory of 2448 2988 msedge.exe 98 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99 PID 2988 wrote to memory of 1972 2988 msedge.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\HermeticWiper.exe"C:\Users\Admin\AppData\Local\Temp\HermeticWiper.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1484
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ExportRevoke.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4800 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:636
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SwitchUndo.odt"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\CompressUninstall.svg1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd0,0xfc,0x120,0x40,0x124,0x7ffd38d246f8,0x7ffd38d24708,0x7ffd38d247182⤵PID:792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:82⤵PID:1972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:12⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 /prefetch:82⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,16784435054676326808,9775745542908119780,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:1908
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2820
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Downloads\DismountStart.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2324