28003e192af4b86fabfa9093ac66273723182cbcca0e5c16b8420bcbd6a98a35

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2023, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f_00019e.exe
Size

579KB
MD5

122b29e72343fc7f3f710db8f06531d0
SHA1

f7a0a60e5e075818acb340dbb7f27ad1c4d9412e
SHA256

5cd3af33918ad0ab9d279c7cd338070cfce68b37f641f489abf494260a3bff16
SHA512

3016962d8e2ff8d75332b37832813ea7139400f0c82fcef1f442f7cdbb285a17ae0637e22cdd2597c35f0b7f4d38b5c9b1700f24647a0c21086443bfcd59bfca
SSDEEP

12288:R4V9pd53hG0IS66lyzAJ2wkJOZ9azQoBHGa1BI0ZkqaFcHDSg9POXmYAYNj:09pm4xoTBbklFcH2g9WXpN

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
4460	f_00019e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	f_00019e.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	f_00019e.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	f_00019e.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	f_00019e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f_00019e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7e3317c5-2080-4013-b6a4-65a7350b5ed1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230215121132.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 440646.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
4460	f_00019e.exe
3596	msedge.exe
3596	msedge.exe
3396	msedge.exe
3396	msedge.exe
2572	identity_helper.exe
2572	identity_helper.exe
4236	msedge.exe
4236	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3396	4460	f_00019e.exe	84
PID 4460 wrote to memory of 3396	4460	f_00019e.exe	84
PID 3396 wrote to memory of 1968	3396	msedge.exe	85
PID 3396 wrote to memory of 1968	3396	msedge.exe	85
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 936	3396	msedge.exe	86
PID 3396 wrote to memory of 3596	3396	msedge.exe	87
PID 3396 wrote to memory of 3596	3396	msedge.exe	87
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88
PID 3396 wrote to memory of 1104	3396	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\f_00019e.exe
"C:\Users\Admin\AppData\Local\Temp\f_00019e.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softdl.360tpcdn.com/auto/20230210/19_d6c3928e9e98cf98c15c79840a31ae6e.exe
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff54a446f8,0x7fff54a44708,0x7fff54a44718
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1d4,0x22c,0x7ff706ab5460,0x7ff706ab5470,0x7ff706ab5480
      4⤵
      PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1116 /prefetch:8
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3200 /prefetch:8
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3228 /prefetch:8
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4964 /prefetch:8
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3604 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2172,14460778999192401211,7347840149407526531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3196 /prefetch:8
    3⤵
    PID:3804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
993e8b8577c97c7e05f2f14fc91b6822

SHA1
115472cc6481473f1c16844a855938390134bb2e

SHA256
0455176415d825ae6af414e9e4ea77bb8e81b521996bed8f14c3b72c24a953d4

SHA512
df59164579d3ee35fa3a89db6f5f3c7754069fd6d2d4014d87a9be9dbbc960ee52d0b9701174dada349491a9d3ebfb025ba284fee5da9998da5ca224d9f249cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
1b28da54d619d388d2521ef6502b63d7

SHA1
5963298ecdc3cecd987dc903fa638d08e623a34b

SHA256
0e5e5ff8d8f6493295c7aa7cfd2f44277e214a964068abf07406db9bd265884f

SHA512
e6b923e332ba0001f036d8db9154e3203a1b59fe778a8177485e57a04605b643dca1959f8fe61da28c1c7e223fd08f357e165ea93a6793718f71a6f0d85661b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kNqSjFsFjHmVyUzA\360ini.dll

Filesize
4.3MB

MD5
a372b8e5e28fdcf3fb0883e002de206b

SHA1
a223c007b074e43056e51012f3162291505a2705

SHA256
3de01cc23705f1da5ee391dfc93612cf270370f967d8caac35fb94ae31aab7c8

SHA512
be3cb1f9dcace7cb9cae90d9de85c7ff3c1e95cd66b904ab4dda55099eaacecacbf9e34fac28ad8b1a4012fab855149ec58228f669e345fecefe3d5f51f46d7d

Download Submit