Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2023 22:09
Static task
static1
Behavioral task
behavioral1
Sample
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe
Resource
win10v2004-20230220-en
General
-
Target
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe
-
Size
539KB
-
MD5
b6a7b3fc99d71c87afc3856856cb4602
-
SHA1
997c27f1efa078dcd3c7c17424979ac8607d38c1
-
SHA256
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df
-
SHA512
310465f12490ca1a91dd93d3a77bc68654ad33bdd168a9cc5e73e7f2cbcaac3778e40557d621b07d997bd40332359ea29aa012009d245053651f32244e3e060a
-
SSDEEP
12288:qSBNOlXxDWKz7K8mNuwBwDhwd261vF14YrcbEnq5JujEC+aW9L:zY01ObwS0jEC+aW9L
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exepid process 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe -
Checks for any installed AV software in registry 1 TTPs 4 IoCs
Processes:
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exedescription ioc process File opened for modification \??\PhysicalDrive0 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exepid process 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\17bae924-335f-4f36-820b-996fae77ca8e.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230407001019.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exe2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exemsedge.exeidentity_helper.exemsedge.exepid process 1192 msedge.exe 1192 msedge.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 1792 msedge.exe 1792 msedge.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe 3712 identity_helper.exe 3712 identity_helper.exe 820 msedge.exe 820 msedge.exe 820 msedge.exe 820 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msedge.exepid process 1792 msedge.exe 1792 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exemsedge.exedescription pid process target process PID 2708 wrote to memory of 1792 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe msedge.exe PID 2708 wrote to memory of 1792 2708 2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe msedge.exe PID 1792 wrote to memory of 1864 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 1864 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 2452 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 1192 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 1192 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe PID 1792 wrote to memory of 796 1792 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe"C:\Users\Admin\AppData\Local\Temp\2730f3fde032339327806f31b491fb4254718f4ce607d6d18f17f14259b107df.exe"1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://baoku.360.cn/2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ff92a8f46f8,0x7ff92a8f4708,0x7ff92a8f47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x134,0x22c,0x7ff7e9445460,0x7ff7e9445470,0x7ff7e94454804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,12653259184848533049,7311000991810454111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8Filesize
2KB
MD5b89d0790998ffce54f3492dd57a8f515
SHA18db7ddc3275e99279703e7d22c0525515fdeb64a
SHA2568b95a9134a8139b7d225cc16379acb33dd12ddcd6937386f83b3a448455458e6
SHA512b434ae0ad7842b5a7bcc23de326fc2e4aa09d46814b10f49a19a7b6d6a09a0c27718d1bf8b91f4dcee29de9cbd95abf3dcb84774b596e3af009dbc5bbf5155c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD5c97719e1ef3b8a984fefecd795e00952
SHA1840ddea4fb5b5bd686561ca3773e41ec0bb6eebc
SHA256b2e05305cab46dd563531bf03b63104237845b7279f7b986d8659bf63f3de3a0
SHA512bb24c4e897b044615c19d1d8496d73c8ed2a058d44167099616c9f02707409ca3a50d39ff4a1d644586fbda3bf797f2b62251a631b7379c39f9a912d446c54b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_90887DD7920637A743EF36CB9A88B5D8Filesize
488B
MD512a842cf32c3c5b603473103f9bddca3
SHA1535accc9d6da00c0a757f8749cbb18f217b1264e
SHA256b3e7cd99051f318dc3f7b2bdae7c9856e2d8ad16f4f40ea812c62bef426a1286
SHA512f1b54b4e865e8171ef680404a23d1e0f2b3d9302cafecf0806f1ca291b3df85ad8115f8440b3b8e396396f1496f1cc4b0ad6626846f06bb8278404d367bf9d3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD553e5617c065dffa7098f8fcd4d9b2d13
SHA18d064567bb34cfc98d4f09d9e2139cce1f8e77b5
SHA25648e1bd1c2538b101a58d8315586e3a1bec0494b7fc63c02f1c74dd7c8d65aa7f
SHA512451d3619932070536f8943ff3475fc0e60a3b73f724db4e7f3509be1d827c6a63864e85ef74b9b3bb3430737639d3e4eb135866342cb0abf1575dc1b006475c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b8c9383861d9295966a7f745d7b76a13
SHA1d77273648971ec19128c344f78a8ffeb8a246645
SHA256b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e
SHA512094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD591fa8f2ee8bf3996b6df4639f7ca34f7
SHA1221b470deb37961c3ebbcc42a1a63e76fb3fe830
SHA256e8e0588b16d612fa9d9989d16b729c082b4dd9bfca62564050cdb8ed03dd7068
SHA5125415cd41f2f3bb5d9c7dadc59e347994444321cf8abe346b08e8c5a3fc6a5adae910eda43b4251ba4e317fbb7696c45dba9fd5e7fa61144c9b947206c7b999c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD57c45199ef5024150ed0b745cff087bdd
SHA157bc69ce4f94c5310899b054be5664c20d386772
SHA2565246c5872f6d7670986611c4767d044e1d969920fce55e4c9be3b62106b21cec
SHA51222871ceb907a05329cb40a08dc6950864e3b822f02e0bf45ba2d18fc1a0e1c4229dfcd876d57b9e29abf8c10d73c0b7d18fd9ecc282ee1ca7bec50542a3876e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
264B
MD572c3b0eacb9daa6ea24e44b95e09af0f
SHA1d6698481e4e2866c834833f7cfb1ccfca5da9c4c
SHA2567a1da5c8deaece9e5e16b365507a2e3bed772b6d96016dfc9bdc20da819b6afa
SHA512b8344e47be99ab4481e743afe4e3028a6e302d40ffe17cc99a9c1730a745fe6dc4cbc4398600d605c3b385c29d306ef5450a3c976dfae1ea055e0e29603a0dd1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD522f50019abbd833c1e34eabdfdd316be
SHA17319afb40d6beec017e34bcc04e84e2bbc409d79
SHA256ebab91962dcb4784b641d9173a7cb429a324bb432a0449c97ea72c0775878ee4
SHA512224d4de88fbdff8a7f34c1f24f01bd758320505f6569f0693f786d2c51c41e2e9dd4878729433eece55701864ac3213e06c72f9b836068062d6736305a53a964
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
258B
MD5b0dcb775802899943fc175f93f8a3636
SHA1f253b6392f483dd7df4c0757d1a99957324691c2
SHA256a65c3503a5cde94734dbd89e719a621ec8efa21bcc59882fb61662653dd38907
SHA5124968eeaa6259282ece9646b24c62b04d7025617f50d4f6e928971a282881b32cf67e7d0c7ac794b08d795517740666960604aadc767dfd25af8cebcb34e21cfb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5bfa6a0247968152f09bd4c26f906a021
SHA183a3f6be30463bb4819284b2aaed6dc87c7c84a9
SHA256e75e0596503217aca27c5369f8de88fc8f1dd75bde4d9ec4a1da443db2c1c59b
SHA51262987de295fa965527bdabd2c3fb5cae3da86b231afcb20c50c7f94a1bc0932ed7070fd8ca1e1f250768e53cb67680dfbfc7bdf6ae8aa9af197065367037a578
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD550c8d57d2242f06308752ca57f522cb5
SHA11206b5d9d103bd50059dc5d3b3eaa29c0ab4a074
SHA2568f6d2c845d63bc7bbbdfe53178010cce704a96e42c386c828ec26574cb06fa29
SHA5124f5aa2de82df4ad6d221399cd7e2cdace35d3f1509629eabf189ac1ddc25c760f6cf36057da970e3701121240fdb131e73eadc4d00117247477dc267b5533e52
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5bd8e0e2e83fade2a9e45cb2e32b71d05
SHA130714e668335103d39f2440c4d36f0fff1064336
SHA2568c2980ad248ba01b7caa58c090c507cec14c2b7137cf41e4fa9b7d86a109c3e7
SHA51261666beae421dc36a67758904076bef9f5c440bc030b1bc4d81296ada54bea80aed75f51a9cefc45d45a67e762b40638d509154fcf6a414473d46659883f8226
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD560b345592703258c513cb5fc34a2f835
SHA139991bd7ea37e2fc394be3b253ef96ce04088a6d
SHA2567e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300
SHA5120346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5e6d686ee740d4e0f460164c0c2374d37
SHA17cb91c5e455e3c32b402bcd6a1e9b717c81cb623
SHA256f8d66f70a2b4c39e4dcd490238e38e22b9febc9487baf23c5cb9fa47b25fb746
SHA51219eaa474ed30bf2e84425213d60afd49ba01db8032d58397a79232154d186ffd8fbaa8fc7f8cb6006b2487740960ada12a64a36b6f2f9dfa49c839530a63515b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5df23f72d7a3399b25c66bf85b2ebbe3c
SHA11c357ccc86a3302f3904c833fd7e9073ba3aa6ee
SHA256c83c28c55236183f2a1a497265e53ca279771adf7bb07063d9d177f6cea3047f
SHA51264a6a71c61b4148b452389a725fccce4a33403d6e66a6af2c8572c3dff7f1eff71f7f769f4e0f26512a081ba28ef23ab7fe75baaa5ecd63f0c461f434a4530c0
-
C:\Users\Admin\AppData\Local\Temp\vOuHkRqXnIbKiTzR\360ini.dllFilesize
4.2MB
MD511f2c5eb90ee5bfb92ca6d83f699dd58
SHA1b3b83df9bb699e69280ccf13fc46473f2c82ef51
SHA2566a1045a9947b3d401c027360af042b16f642be10426ccda65a9e705314c483f9
SHA5120eeb2363e013e8f3b9ee75c8e190a8d992791d174f9035f5aec7ba25a18e73e1c0076c5f7946597f9644fda6bdd28a5ea5a730aed1b067ac4269abb5f71017db
-
C:\Users\Admin\AppData\Local\Temp\vOuHkRqXnIbKiTzR\360ini.dllFilesize
4.2MB
MD511f2c5eb90ee5bfb92ca6d83f699dd58
SHA1b3b83df9bb699e69280ccf13fc46473f2c82ef51
SHA2566a1045a9947b3d401c027360af042b16f642be10426ccda65a9e705314c483f9
SHA5120eeb2363e013e8f3b9ee75c8e190a8d992791d174f9035f5aec7ba25a18e73e1c0076c5f7946597f9644fda6bdd28a5ea5a730aed1b067ac4269abb5f71017db
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD525e40517f74248edcecebb4ab7ee98db
SHA1bc474e4e24528ffcf54696a52e410710b5371ec6
SHA256343600469a8423d8be65e4944fbb11ca014613982bfb4d1033153a7ea7ffed02
SHA512ad9a37e52eb3d794c658ac28bc7de9de83ea859a15b0d9979b1cf82a116bbab655ca504cdf1e21acfe90a05ae06b511efbec8cd45eed330b3c2455ed08d43a15
-
\??\pipe\LOCAL\crashpad_1792_SLVQWQSXPGFZHLDUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2708-133-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB