hxxps://mega[.]nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE

Resubmissions

31-03-2023 17:55

230331-whl5psde7y 10

31-03-2023 17:48

31-03-2023 17:47

31-03-2023 17:39

31-03-2023 16:18

Analysis

max time kernel
1897s
max time network
1961s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f4544afc-8e06-436b-aa3d-f592174262b3.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230331190752.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 24 IoCs

Processes:

SearchApp.exeSearchApp.exemsedge.exeSearchApp.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exemsedge.exemsedge.exemsedge.exe

pid	process
1544	powershell.exe
1544	powershell.exe
4048	msedge.exe
4048	msedge.exe
2496	msedge.exe
2496	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe
692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

2496 msedge.exe
2496 msedge.exe
2496 msedge.exe
2496 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1544 powershell.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

2496 msedge.exe
2496 msedge.exe
2496 msedge.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SearchApp.exeSearchApp.exeSearchApp.exe

pid process

3040 SearchApp.exe
1120 SearchApp.exe
4824 SearchApp.exe

pid	process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

description	pid	process
Token: SeDebugPrivilege	1544	powershell.exe

pid	process
2496	msedge.exe
2496	msedge.exe
2496	msedge.exe

pid	process
3040	SearchApp.exe
1120	SearchApp.exe
4824	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2496 wrote to memory of 5028	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 5028	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 2988	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 4048	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 4048	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe
PID 2496 wrote to memory of 900	2496	msedge.exe	msedge.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9016546f8,0x7ff901654708,0x7ff901654718
2⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
2⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
2⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:1
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
2⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3880 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
2⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9458701874012595403,6503091630939188353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3408 /prefetch:8
2⤵
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
- Drops file in Program Files directory
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff68ee35460,0x7ff68ee35470,0x7ff68ee35480
3⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3040

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\bd56fbbb66dc4858a7c6ec4765ac6485 /t 2600 /p 3040
1⤵
PID:4860

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\460656d3a7f34810b4921e5239896aca /t 4896 /p 1120
1⤵
PID:3416

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
5a10efe23009825eadc90c37a38d9401

SHA1
fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

SHA256
05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

SHA512
89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c1a3c45dc07f766430f7feaa3000fb18

SHA1
698a0485bcf0ab2a9283d4ebd31ade980b0661d1

SHA256
adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48

SHA512
9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
dc143cea7f35f9beb4c653af3440a0b0

SHA1
06ab96507d1da0ee3b37ed257c5c098acf2d8549

SHA256
2fb4ad1421a7a537c42befa78870feeaf435e3dcb354f3d1224b937d10209d17

SHA512
283b3f69afb2cd3e3a2ac1f13e2c2b865b5d2fa3d8c838e40fb0347c3a414a091909b7ac722407568890fcd6e540eaf13737dafc1546beb8544333c28912e1ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe643f2c.TMP
Filesize
48B

MD5
53dcd8e21f62b17d6ea63248b5730b38

SHA1
a06f3e92d9fa5e4ca47c114d4c111e4b09a8919e

SHA256
4e446552ac350c6a31fe8013b0880e3467e1ceb7d02471ad1dbc48d3285a2378

SHA512
79e0a85f261e0f07b7fb7e15dfb096b8ea59fe8be1ec468858a11f1c32dead88eeb9a5506c76cfa903030f189358089e754da4ada62b99bec40af07221caf6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
37b961641b1a8f6a92735c591d256e10

SHA1
554367a7eea79b21277c21af6a22ce2b197cbeb5

SHA256
583d4c41c445cfa8592d8b546152f46faa670170b0b014a25f9ecabd31dcb10c

SHA512
8decc3af62877c082f760e0b0016af55f13d3c42c682c0f04b2676edeb43c78e967d7d7fc61fc3fc77dc435f45c4865202cb07da8c2b6a07464109ec474e6ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
b2563a50f49de76e0c5bad871dab8b2f

SHA1
3ba656d0eb240333fb133b1bcd6864012c7914fc

SHA256
6c7312014593e82214fa286435c66c51dae9458d5509eadae5b1f79a6c059429

SHA512
ea03ddc4fb7ee0023c2ca24e4e0a79032aeb36f8ca0845a683b8b572fe99c0f18cdd3a191e04ad0a044a4753b40809637f3c14278d2d55cd9a9f75daa87e40fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
86f7a85c6aed81a576432d791b3f3818

SHA1
155382184e0aa0bf3bb03b29b47db079dbc7c65f

SHA256
67d316633b851faa8afc07bf4ab15df4afab890803cc221ad97d350882cf2d0c

SHA512
900b9db45456918c0cdcb80b8a990501e9b21427c7a2aada931e2219a6d5e619927d7bb5243eca47152a5f504025381ee96baa25f1b932ad5d41d22c242b5084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2cfbaa439b83a89787677d09641bc9a9

SHA1
3eba0289e0b149428b7ac8151acaa2ee93073da7

SHA256
50e9d31e85bb2236988502a562d79b88fe77e4d42769d34ca2e3f72c836930f5

SHA512
78c054565d8cca2db8a04e7a6cec2c3146cdf1f4bbdffc2702fe9e80472a3768c2ea6b5a099c9ea2facd0660de1db465de2acf27e078ebb4199160670eb549bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
63f8b550c22e33d9a6db0c57ed6c1478

SHA1
75c6527e8ac3f631d13d1f7aab1c5cd0fd779f52

SHA256
dc21a9d8af9209a2f43832d0674c404325be65f8f8512b84cf8320f1d60d80e2

SHA512
037eb42021e28fe9271e4f93b46d1427df236fc4dc826e7b8574f368d2824aeeb2d4965f23ad126d966cfab54e76b0f818a3f30594decb9cae3b300b86634491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a7aa520ccb4d30cfd1facac816a1812e

SHA1
62da9c6473745e42cfd94fe12df707b01def4ee5

SHA256
e255ea477bd9676e5ea2f6a95551abc015da5dde5e1d6a689ac9e5df9742343d

SHA512
efb58f80138914cc71ee4cb6a01c90c9c921b30e7f810c0c7bde53631af710bbfda6717b742522d5aebca1d529da502451b5e6b734f309ff511c901e93d70a4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2157aa521107ba446b1ccf05887119b9

SHA1
92cf4481db157540ca886b3b2e15b35a641d9560

SHA256
72dc994d3fd857d67fc86acf012a40ef7060e4ff101e46a60ff3b0b9b84f8a1d

SHA512
4bc8c4d7206a99f7caac7195440d822f2ee9d367fbd2c1f5a33878b438b177bf571f75551a1a20819460e81f766944bb389ab4434eec2bc9517ca7181d70fed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
5edab6d3ffbeee247ccb4423f929a323

SHA1
a4ad201d149d59392a2a3163bd86ee900e20f3d9

SHA256
460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933

SHA512
263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
3KB

MD5
5504a705e0d4110d91dc073f8879e30c

SHA1
8720a709eea7790308c7e670946d7ea2db8c7eee

SHA256
34a51dd6e0d28f906f9386861d27643f984f17ca3ae281cba405f0e798c239d3

SHA512
455a68a170ebef746828565a1656994644ae2a58db49650604c5acd2bfd903e9a52251eeb294b866c9403c993a637b6c816064877bd41c6650dbcf627a7655d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
3KB

MD5
63f51dbfe216f7ef55d03ad78dc7159e

SHA1
663bf49d3bb455b8ccef929d49230efa2a0947c2

SHA256
2ce9a6a468e0b0ff7eaa18db8baf62ca61f005b9f88c682f2d88157e30f84852

SHA512
a9c9d14d636f50fc69f772d7e6cd56d0cfd4be6732ec26f1d420db1ad8ea3e231a190bbcae9eedcfa077892d531d572ad08e4e3b0d3aebf6ca07d741c555db1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
369c5e684bb902298e6a395ddf237188

SHA1
488178b03cf1b875495d120ac4c979ea86828a50

SHA256
c63fdda48c98b3ab4a48a62f225463fee6e3397a6127cdc1ce9438dd4bc11741

SHA512
4e56f587487c03281f20b0fb7f5757876029fa588fa1db62ecf79bcbfaf50b9e9bfdeb386652b21c44da292f91bcf308130822f2481cbb941ef865e5340c6de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
3KB

MD5
a3585de19f3bcdd8bb74b3d2d8ddc635

SHA1
9ca8c0b5320a0be7f3986ede349d1be7a941fdc3

SHA256
190befd7e39cec61af6c11b1666324aa690bcd26abdbac1b1a75635b3e4f15ff

SHA512
7107c3c181adf7aaaa0948b214b776fa1d7576e7decf5bd23d291bab3d484fc4996ddc3b872c0ee9857ac2fe71346cd6829f3a4f33df2b7fad4aa4730edb29df

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tqkwhpsh.aqq.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\LOCAL\crashpad_2496_QBGAWLAUQCYZGCKY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1544-146-0x000002867A3D0000-0x000002867A3E0000-memory.dmp

Filesize
64KB

Download
memory/1544-147-0x000002867A3D0000-0x000002867A3E0000-memory.dmp

Filesize
64KB

Download
memory/1544-148-0x000002867A3D0000-0x000002867A3E0000-memory.dmp

Filesize
64KB

Download
memory/1544-145-0x000002867A3D0000-0x000002867A3E0000-memory.dmp

Filesize
64KB

Download
memory/1544-144-0x000002867D370000-0x000002867D392000-memory.dmp

Filesize
136KB

Download
memory/1544-133-0x000002867A3D0000-0x000002867A3E0000-memory.dmp

Filesize
64KB

Download
memory/1544-134-0x000002867A3D0000-0x000002867A3E0000-memory.dmp

Filesize
64KB

Download
memory/4824-458-0x000001CE83BB0000-0x000001CE83BD0000-memory.dmp

Filesize
128KB

Download
memory/4824-461-0x000001CE83E80000-0x000001CE83EA0000-memory.dmp

Filesize
128KB

Download
memory/4824-466-0x000001CE83EC0000-0x000001CE83EE0000-memory.dmp

Filesize
128KB

Download
memory/4824-540-0x000001CE81200000-0x000001CE82B2F000-memory.dmp

Filesize
25.2MB

Download
memory/4824-609-0x000001CE81200000-0x000001CE82B2F000-memory.dmp

Filesize
25.2MB

Download
memory/4824-621-0x000001CE81200000-0x000001CE82B2F000-memory.dmp

Filesize
25.2MB

Download