Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2023 14:01
Static task
static1
Behavioral task
behavioral1
Sample
eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe
Resource
win10v2004-20221111-en
General
-
Target
eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe
-
Size
184KB
-
MD5
349971557e88ced0c1c06877525daa27
-
SHA1
88c74c2b2dc0226a6e2a8f734c85ded9e2af47f8
-
SHA256
eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8
-
SHA512
87102f7d9d2cddf490e411ffbc00247cd0edae307b3bddbfb09f3a3fd4d93913b14376af642ee31ae1d80f2e5e61a677d572fc3d35233a9609f52ba5fd983bae
-
SSDEEP
3072:x/BgPvTmL4bjsuPJqZGmtKG1g1OZ6PWvXI6b/VkTYY49ID9pCtDm:x/+NXsuhMREG+1VII6bVpcD9Q
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/760-133-0x00000000006E0000-0x00000000006E9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
FC48.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FC48.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
FC48.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FC48.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FC48.exe -
Executes dropped EXE 3 IoCs
Processes:
E89F.exeFC48.exe5584.exepid process 2208 E89F.exe 4652 FC48.exe 4272 5584.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/4652-181-0x0000000000760000-0x0000000000F94000-memory.dmp agile_net -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\FC48.exe themida C:\Users\Admin\AppData\Local\Temp\FC48.exe themida behavioral1/memory/4652-181-0x0000000000760000-0x0000000000F94000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Processes:
FC48.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FC48.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5584.exedescription pid process target process PID 4272 set thread context of 4156 4272 5584.exe AppLaunch.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cefd275c-3522-4455-b58f-c42734e07339.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230217150226.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 4 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exepid process 760 eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe 760 eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 2492 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2492 -
Suspicious behavior: MapViewOfSection 37 IoCs
Processes:
eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exeexplorer.exepid process 760 eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe 2492 2492 2492 2492 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 2492 2492 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 2492 2492 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 2492 2492 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 2492 2492 1788 explorer.exe 1788 explorer.exe 2492 2492 2492 2492 2492 2492 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3556 msedge.exe 3556 msedge.exe 3556 msedge.exe 3556 msedge.exe 3556 msedge.exe 3556 msedge.exe 3556 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 Token: SeShutdownPrivilege 2492 Token: SeCreatePagefilePrivilege 2492 -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
msedge.exepid process 3556 msedge.exe 2492 2492 3556 msedge.exe 2492 3556 msedge.exe 2492 2492 2492 2492 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 2492 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
FC48.exemsedge.exedescription pid process target process PID 2492 wrote to memory of 2208 2492 E89F.exe PID 2492 wrote to memory of 2208 2492 E89F.exe PID 2492 wrote to memory of 4652 2492 FC48.exe PID 2492 wrote to memory of 4652 2492 FC48.exe PID 2492 wrote to memory of 4652 2492 FC48.exe PID 4652 wrote to memory of 3556 4652 FC48.exe msedge.exe PID 4652 wrote to memory of 3556 4652 FC48.exe msedge.exe PID 3556 wrote to memory of 4760 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4760 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 3936 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 2196 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 2196 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe PID 3556 wrote to memory of 4064 3556 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe"C:\Users\Admin\AppData\Local\Temp\eef4b9da665969c538717fecd8ae1c0ae2948e09ab86745f2b847aedf1b3fee8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E89F.exeC:\Users\Admin\AppData\Local\Temp\E89F.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FC48.exeC:\Users\Admin\AppData\Local\Temp\FC48.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=FC48.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9ce5746f8,0x7ff9ce574708,0x7ff9ce5747183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5412 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5484 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff666cf5460,0x7ff666cf5470,0x7ff666cf54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1940 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1464,9127238870228336520,6499022987494673513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=FC48.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ce5746f8,0x7ff9ce574708,0x7ff9ce5747183⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\5584.exeC:\Users\Admin\AppData\Local\Temp\5584.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c71cb7463c49e125cbae14ac265cf18f
SHA14430c030546d725e7f6e5584f139e012e9214f06
SHA2561eb6d93849a5c52e9b381fc0abd82b401e2d1e5dfbedd48a3cff50e91e758018
SHA5122f1317d23dfe8c39760e51900cfaed49a2ba4675f0904ec033252e037e0eb935e59b4cc0b8c11c4acd7cfbddf0d9d461f5a66504494863c2bb7781aa3c000eed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5f0522f3febfc678c76174bf1a058ea3e
SHA15ca39c34955a65387da5a7c7ba4ba4f023db4e0f
SHA256efe830faeef3634f187a5de3275652a9295a0dcfba165a256f3a846afbdd699e
SHA5122511ff0c4f01adace7fb8ca6a9c2cade94863811196a3801a4a96588cd3d9f2e60e471c0a9fe164d214feb48068636d9920cb7fa9d3bf48d25a1ad3a103add2c
-
C:\Users\Admin\AppData\Local\Temp\5584.exeFilesize
344KB
MD50907dc351caecbe56e4ae22c041efd17
SHA1019335863db510b409415c574764c7728a5831ec
SHA2569aef4e5ba4269eeaf266e914e7d48b9ed3e947da9345ec7a9d9e860d6798ea3d
SHA51261518ad3b9c29ff7d53ab755ca0a4ee66a1e522cf0cd30d7baceb2597dab0c4896597207a0eaf5acfef5b0b5a08b52e9267ebd24ec5f6d15349ac97dcacdcee8
-
C:\Users\Admin\AppData\Local\Temp\5584.exeFilesize
344KB
MD50907dc351caecbe56e4ae22c041efd17
SHA1019335863db510b409415c574764c7728a5831ec
SHA2569aef4e5ba4269eeaf266e914e7d48b9ed3e947da9345ec7a9d9e860d6798ea3d
SHA51261518ad3b9c29ff7d53ab755ca0a4ee66a1e522cf0cd30d7baceb2597dab0c4896597207a0eaf5acfef5b0b5a08b52e9267ebd24ec5f6d15349ac97dcacdcee8
-
C:\Users\Admin\AppData\Local\Temp\E89F.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\E89F.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\FC48.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Local\Temp\FC48.exeFilesize
3.0MB
MD54df973fc60804e9bc6a8051582351ee5
SHA14ddc2e8ef17773fe4b7a29ea8634ff92861cd647
SHA256bd036b1298af5791d217f59dcedb65fd719f942f7da224bdf6cea433d45c34b1
SHA51286633629198870b36a5d9b28178140a4892f75581ac0f2bac77cb744bbdf0c7e2453656a31db4a4a9418d532212f3ed31a7061a0b84aa4bcc37da0f0d907048e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkFilesize
2KB
MD5a791240531b0ab269138bd39d2320625
SHA1dc6fec3d07f1c97b33edb389182e302218edcbab
SHA256b62523a0a9e2949add064c4ac5be088ef993a1b28a851347fe05c58ac7a8265d
SHA5123cb27b760dba0cde225a4a20ee91714483f186f8b266455ad5d99c31159c57043cf4bc20f5f3e61fdd1ed69e1267a189354c7b5e904ff1fc21385f1072b65391
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD50488e91ed58a309fa18c0f0a2d836d6d
SHA1f87db7c4aa35527968b9569f3349f3203fd00070
SHA256273950cb6eae5faef8feae86b219dd20d1ad40290c038aaf461d89e9eff92d5d
SHA51295b67127176e8b7a70e7d65615c8868a45ad5a8531f29bf7a7232cb505ece51fbb8965d45910645af09f123ab84ad0bf47defa15e8e6822ad802f65fa62045d4
-
\??\pipe\LOCAL\crashpad_3556_DURMSWRXYQABHHPIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/652-248-0x0000000000460000-0x0000000000468000-memory.dmpFilesize
32KB
-
memory/652-239-0x0000000000450000-0x000000000045B000-memory.dmpFilesize
44KB
-
memory/652-238-0x0000000000460000-0x0000000000468000-memory.dmpFilesize
32KB
-
memory/652-237-0x0000000000000000-mapping.dmp
-
memory/760-132-0x00000000008D1000-0x00000000008E4000-memory.dmpFilesize
76KB
-
memory/760-135-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/760-134-0x0000000000400000-0x000000000055F000-memory.dmpFilesize
1.4MB
-
memory/760-133-0x00000000006E0000-0x00000000006E9000-memory.dmpFilesize
36KB
-
memory/796-158-0x0000000000000000-mapping.dmp
-
memory/1080-243-0x0000000000930000-0x0000000000936000-memory.dmpFilesize
24KB
-
memory/1080-210-0x0000000000000000-mapping.dmp
-
memory/1080-214-0x0000000000930000-0x0000000000936000-memory.dmpFilesize
24KB
-
memory/1080-215-0x0000000000920000-0x000000000092C000-memory.dmpFilesize
48KB
-
memory/1112-164-0x0000000000000000-mapping.dmp
-
memory/1116-180-0x0000000000000000-mapping.dmp
-
memory/1152-177-0x0000000000000000-mapping.dmp
-
memory/1252-247-0x0000000000890000-0x0000000000897000-memory.dmpFilesize
28KB
-
memory/1252-236-0x0000000000880000-0x000000000088D000-memory.dmpFilesize
52KB
-
memory/1252-235-0x0000000000890000-0x0000000000897000-memory.dmpFilesize
28KB
-
memory/1252-234-0x0000000000000000-mapping.dmp
-
memory/1504-242-0x0000000000990000-0x0000000000995000-memory.dmpFilesize
20KB
-
memory/1504-207-0x0000000000980000-0x0000000000989000-memory.dmpFilesize
36KB
-
memory/1504-204-0x0000000000000000-mapping.dmp
-
memory/1504-206-0x0000000000990000-0x0000000000995000-memory.dmpFilesize
20KB
-
memory/1548-220-0x0000000000000000-mapping.dmp
-
memory/1548-167-0x0000000000000000-mapping.dmp
-
memory/1548-244-0x0000000000590000-0x00000000005B2000-memory.dmpFilesize
136KB
-
memory/1548-223-0x0000000000560000-0x0000000000587000-memory.dmpFilesize
156KB
-
memory/1548-222-0x0000000000590000-0x00000000005B2000-memory.dmpFilesize
136KB
-
memory/1624-240-0x0000000000EC0000-0x0000000000EC7000-memory.dmpFilesize
28KB
-
memory/1624-187-0x0000000000000000-mapping.dmp
-
memory/1624-194-0x0000000000EC0000-0x0000000000EC7000-memory.dmpFilesize
28KB
-
memory/1624-195-0x0000000000EB0000-0x0000000000EBB000-memory.dmpFilesize
44KB
-
memory/1788-197-0x0000000000000000-mapping.dmp
-
memory/1788-241-0x0000000000DE0000-0x0000000000DE9000-memory.dmpFilesize
36KB
-
memory/1788-202-0x0000000000DD0000-0x0000000000DDF000-memory.dmpFilesize
60KB
-
memory/1788-201-0x0000000000DE0000-0x0000000000DE9000-memory.dmpFilesize
36KB
-
memory/1884-156-0x0000000000000000-mapping.dmp
-
memory/2148-256-0x0000000000000000-mapping.dmp
-
memory/2196-151-0x0000000000000000-mapping.dmp
-
memory/2196-213-0x0000020252870000-0x000002025287F000-memory.dmpFilesize
60KB
-
memory/2208-136-0x0000000000000000-mapping.dmp
-
memory/2208-139-0x0000000000B30000-0x0000000000B38000-memory.dmpFilesize
32KB
-
memory/2208-140-0x00007FF9CCF10000-0x00007FF9CD9D1000-memory.dmpFilesize
10.8MB
-
memory/2656-171-0x0000000000000000-mapping.dmp
-
memory/2664-250-0x0000000000000000-mapping.dmp
-
memory/2820-175-0x0000000000000000-mapping.dmp
-
memory/3436-252-0x0000000000000000-mapping.dmp
-
memory/3556-203-0x0000017A2FF60000-0x0000017A2FF6F000-memory.dmpFilesize
60KB
-
memory/3556-147-0x0000000000000000-mapping.dmp
-
memory/3936-208-0x0000019615CA0000-0x0000019615CAF000-memory.dmpFilesize
60KB
-
memory/3936-150-0x0000000000000000-mapping.dmp
-
memory/4064-154-0x0000000000000000-mapping.dmp
-
memory/4064-216-0x0000017ED2110000-0x0000017ED211F000-memory.dmpFilesize
60KB
-
memory/4088-227-0x0000000000000000-mapping.dmp
-
memory/4088-229-0x00000000001C0000-0x00000000001C5000-memory.dmpFilesize
20KB
-
memory/4088-245-0x00000000001C0000-0x00000000001C5000-memory.dmpFilesize
20KB
-
memory/4088-230-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/4156-198-0x00000000050F0000-0x0000000005102000-memory.dmpFilesize
72KB
-
memory/4156-217-0x0000000006170000-0x00000000061E6000-memory.dmpFilesize
472KB
-
memory/4156-211-0x00000000065E0000-0x0000000006B84000-memory.dmpFilesize
5.6MB
-
memory/4156-209-0x00000000054F0000-0x0000000005556000-memory.dmpFilesize
408KB
-
memory/4156-196-0x0000000005710000-0x0000000005D28000-memory.dmpFilesize
6.1MB
-
memory/4156-200-0x0000000005150000-0x000000000518C000-memory.dmpFilesize
240KB
-
memory/4156-188-0x0000000000000000-mapping.dmp
-
memory/4156-228-0x0000000006C90000-0x0000000006CE0000-memory.dmpFilesize
320KB
-
memory/4156-221-0x00000000062B0000-0x00000000062CE000-memory.dmpFilesize
120KB
-
memory/4156-199-0x0000000005220000-0x000000000532A000-memory.dmpFilesize
1.0MB
-
memory/4156-212-0x00000000060D0000-0x0000000006162000-memory.dmpFilesize
584KB
-
memory/4156-189-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4156-219-0x00000000070C0000-0x00000000075EC000-memory.dmpFilesize
5.2MB
-
memory/4156-218-0x00000000063C0000-0x0000000006582000-memory.dmpFilesize
1.8MB
-
memory/4272-184-0x0000000000000000-mapping.dmp
-
memory/4300-254-0x0000000000000000-mapping.dmp
-
memory/4444-169-0x0000000000000000-mapping.dmp
-
memory/4448-176-0x0000000000000000-mapping.dmp
-
memory/4644-162-0x0000000000000000-mapping.dmp
-
memory/4652-144-0x0000000000760000-0x0000000000F94000-memory.dmpFilesize
8.2MB
-
memory/4652-181-0x0000000000760000-0x0000000000F94000-memory.dmpFilesize
8.2MB
-
memory/4652-141-0x0000000000000000-mapping.dmp
-
memory/4652-165-0x0000000000760000-0x0000000000F94000-memory.dmpFilesize
8.2MB
-
memory/4716-172-0x0000000000000000-mapping.dmp
-
memory/4760-148-0x0000000000000000-mapping.dmp
-
memory/4760-205-0x0000023E7E390000-0x0000023E7E39F000-memory.dmpFilesize
60KB
-
memory/4812-173-0x0000000000000000-mapping.dmp
-
memory/4812-183-0x0000000000000000-mapping.dmp
-
memory/5068-246-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/5068-233-0x0000000000110000-0x000000000011B000-memory.dmpFilesize
44KB
-
memory/5068-232-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/5068-231-0x0000000000000000-mapping.dmp